CVE-2019-17391
Medium
Description
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset.
SeverityMedium
CVSS4.6
Exploit probability—
ProductEspressif Esp32-d0wd Firmware
PublishedNov 14, 2019
First seenNov 14, 2019
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| espressif esp32-d0wd_firmware | No range specified | — |
| espressif esp32-d2wd_firmware | No range specified | — |
| espressif esp32-s0wd_firmware | No range specified | — |
| espressif esp32-pico-d4_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.