Critical severity · published Sep 12, 2019
CVE-2019-14236
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be…
9.8
CVSS
2.3%
EPSS
No
On KEV
Description
On STMicroelectronics STM32L0, STM32L1, STM32L4, STM32F4, STM32F7, and STM32H7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated by observing CPU registers and the effect of code/instruction execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)2.3% · higher than 83% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Stm32f4 Firmware · ST
All versions, or not specified · source: NVD
SF
Stm32f7 Firmware · ST
All versions, or not specified · source: NVD
SF
Stm32h7 Firmware · ST
All versions, or not specified · source: NVD
SF
Stm32l0 Firmware · ST
All versions, or not specified · source: NVD
SF
Stm32l1 Firmware · ST
All versions, or not specified · source: NVD
SF
Stm32l4 Firmware · ST
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14236
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14236
Exploit
https://www.usenix.org/system/files/woot19-paper_schink.pdf
More from Stm32f4 Firmware
6.6
CVE-2019-14238
On STMicroelectronics STM32F7 devices, Proprietary Code Read Out Protection (PCROP) (a software IP protection method) can be defeated with a debug probe via the Instruction…