Buffer Over-Read Vulnerability in NXP LPC55S69 Devices
CVE-2021-40154

6.1MEDIUM

Key Information:

Vendor

Nxp

Status
Lpc55s69jbd100 Firmware
Vendor
CVE Published:
1 December 2021

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2021-40154?

NXP LPC55S69 devices prior to A3 are susceptible to a buffer over-read vulnerability. This occurs during the USB In-System Programming (ISP) mode when a crafted wlength value is sent in a GET Descriptor Configuration request. The flawed handling of this value can lead to the unintended disclosure of protected flash memory, potentially allowing unauthorized access to sensitive information.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-40154
Created by Jeromeyoung

References

https://www.darkmatter.ae/xen1thlabs/published-advisories/
x_refsource_MISC
https://github.com/Xen1thLabs-AE/CVE-2021-40154
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.