CVE-2023-50096: Buffer Overflow
STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeAReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-50096?
CVE-2023-50096 is considered to be a high severity vulnerability due to its potential for MCU code execution.
How do I fix CVE-2023-50096?
To fix CVE-2023-50096, upgrade to the STSAFE-A1xx middleware version 3.3.7 or later.
What devices are affected by CVE-2023-50096?
CVE-2023-50096 affects devices using the X-CUBE-SAFEA1 Software Package version 1.2.0 for STSAFE-A.
What causes CVE-2023-50096?
CVE-2023-50096 is caused by a buffer overflow in the StSafeA_ReceiveBytes function in the affected software.
Can exploiting CVE-2023-50096 allow remote access?
Exploiting CVE-2023-50096 can potentially allow an adversary to execute arbitrary code on the MCU if they can access the I2C bus.