Threat Investigation
Request a demo

CVE-2024-38433

Medium

Description

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution.

SeverityMedium
CVSS6.7
Exploit probability—
ProductNuvoton Npcm750r Firmware
PublishedJul 11, 2024
First seenJul 11, 2024
Weakness typeCWE-305CWE-305

How to fix

Update
  • nuvoton npcm750r_firmware10.10.19 or later
  • nuvoton npcm710r_firmware10.10.19 or later
  • nuvoton npcm730r_firmware10.10.19 or later
  • nuvoton npcm705r_firmware10.10.19 or later

Affected products

ProductAffected versionsFixed in
nuvoton npcm750r_firmwarev < 10.10.1910.10.19
nuvoton npcm710r_firmwarev < 10.10.1910.10.19
nuvoton npcm730r_firmwarev < 10.10.1910.10.19
nuvoton npcm705r_firmwarev < 10.10.1910.10.19

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.