Medium severity · published Aug 7, 2017
CVE-2017-7932
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX…
6.0
CVSS
0.3%
EPSS
No
On KEV
Description
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
CVSS vector
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H
Attack vector
Physical
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I2
I.mx 28 Firmware · Nxp
All versions, or not specified · source: NVD
I5
I.mx 50 Firmware · Nxp
All versions, or not specified · source: NVD
I5
I.mx 53 Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6dual Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6duallite Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6dualplus Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6quad Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6quadplus Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6solo Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6sololite Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6solox Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6ull Firmware · Nxp
All versions, or not specified · source: NVD