CVE-2024-38433 - CVE House
Back to Database
Status published Medium CVE-2024-38433

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

Vulnerability Description

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code execution.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-38433

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Ferdinand Nölscher of Google's OTS-HS Team

References

Affected Vendor

Affected Software

NPCM7xx (Poleg) BootBlock
Vulnerable Versions:
All versions

Timeline

Official Publish: July 11th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-305

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.