Login Request a demo
Medium severity · published Aug 7, 2017
CVE-2017-7936
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX…
6.3
CVSS
0.3%
EPSS
No
On KEV
Description
A stack-based buffer overflow issue was discovered in NXP i.MX 50, i.MX 53, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, i.MX 6QuadPlus, Vybrid VF3xx, Vybrid VF5xx, and Vybrid VF6xx. When the device is configured in security enabled configuration, SDP could be used to download a small section of code to an unprotected region of memory.
CVSS vector
CVSS:3.0/AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I5
I.mx 50 Firmware · Nxp
All versions, or not specified · source: NVD
I5
I.mx 53 Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6dual Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6duallite Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6dualplus Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6quad Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6quadplus Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6solo Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6sololite Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6solox Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6ull Firmware · Nxp
All versions, or not specified · source: NVD
I6
I.mx 6ultralite Firmware · Nxp
All versions, or not specified · source: NVD
Affected product
I5
I.mx 50 Firmware
Nxp
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-7936
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-7936
Third Party Advisory
http://www.securityfocus.com/bid/99966
Third Party Advisory
https://ics-cert.us-cert.gov/advisories/ICSA-17-152-02
More from I.mx 50 Firmware
6.0
CVE-2017-7932
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX…