CVE-2017-7932
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx,…
Published 9 y ago · modified 4 mo ago · JSON
Summary
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
Exploit prediction (EPSS)
0.29% probability of exploitation in the next 30 days, higher than 21% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 6.0 | CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H |
| NVD | 2.0 | 4.4 | AV:L/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- n/a NXP i.MX Product Family
Classification
- Weakness
- CWE-295 Improper Certificate Validation
References
- ics-cert.us-cert.gov /advisories/ICSA-17-152-02 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/99966 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-7932
- NVD: CVE-2017-7932
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.