High – 7
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

PT-2024-40: Readout protection level bypass in GigaDevice Semiconductor products

Error type:

  • CWE-1191:On-Chip Debug and Test Interface With Improper Access Control

Vulnerability vector:

  • Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • Severity (CVSSv3.1): 7.6 (high)
  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • Severity (CVSSv4.0): 7.0 (high)

Description:

The vulnerability was identified in in series GD32E23x, GD32F20x, GD32F1x0, GD32F4xx, GD32F30x, GD32C10x, GD32E10x, GD32E50x of GigaDevice Semiconductor products.

The vulnerability can be exploited by an attacker to run arbitrary shell code in SRAM.

Vulnerability status: Confirmed by research

Date of vulnerability detection: 12.04.2023

Recommendations: Limit physical access to critical devices with the microcontroller series GD32E23x, GD32F20x, GD32F1x0, GD32F4xx, GD32F30x, GD32C10x, GD32E10x, GD32E50x.

Additional information:  Press-release, Research

Researcher: Alexey Kovrizhnykh (Positive Technologies)

Identifiers:

BDU:2024-09909

Vendor:

GigaDevice Semiconductor

Vulnerable product:

GigaDevice GD32

Vulnerable versions:

series GD32E23x, GD32F20x, GD32F1x0, GD32F4xx, GD32F30x, GD32C10x, GD32E10x, GD32E50x.