CVE-2024-53832CWE-522

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30)

Medium · published December 10, 2024

CVSS v4.0
5.1
EPSS
0%
Percentile
20.0
In the wild
Unconfirmed
What it is

A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30). The affected devices contain a secure element which is connected via an unencrypted SPI bus. This could allow an attacker with physical access to the SPI bus to observe the password used for the secure element authentication, and then use the secure element as an oracle to decrypt all encrypted update files.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00286 · 20.0th percentile
Weakness
CWE-522 · Insufficiently Protected Credentials
Published
2024-12-10T13:54Z
EPSS history
Timeline
  • 10 DEC 13:54Z
    A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V05.30)
    cvelistv5