CVE-2022-22819

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.
Classic Buffer Overflow
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
VendorProductVersion
nxplpc55s66jbd64_firmware
-
nxplpc55s66jbd100_firmware
-
nxplpc55s66jev98_firmware
-
nxplpc55s69jbd64_firmware
-
nxplpc55s69jbd100_firmware
-
nxplpc55s69jev98_firmware
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom
https://www.nxp.com
https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom
https://www.nxp.com