CVE-2019-17391: Medium severity espressif esp32-d0wd vulnerability
An issue was discovered in the Espressif ESP32 mask ROM code 2016-06-08 0 through 2. Lack of anti-glitch mitigations in the first stage bootloader of the ESP32 chip allows an attacker (with physical access to the device) to read the contents of read-protected eFuses, such as flash encryption and secure boot keys, by injecting a glitch into the power supply of the chip shortly after reset.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-17391?
CVE-2019-17391 is a vulnerability found in the Espressif ESP32 mask ROM code, allowing an attacker with physical access to read certain eFuses.
How severe is CVE-2019-17391?
CVE-2019-17391 has a severity rating of 4.6 out of 10.
Which software is affected by CVE-2019-17391?
Espressif Esp32-d0wd Firmware, Espressif Esp32-d2wd Firmware, Espressif Esp32-s0wd Firmware, and Espressif Esp32-pico-d4 Firmware are affected by CVE-2019-17391.
How can an attacker exploit CVE-2019-17391?
An attacker with physical access to the device can exploit CVE-2019-17391 to read the contents of read-protected eFuses.
Where can I find more information about CVE-2019-17391?
You can find more information about CVE-2019-17391 at the following link: https://www.espressif.com/en/news/Security_Advisory_Concerning_Fault_Injection_and_eFuse_Protections