What is the CVSS score of CVE-2019-5478?

CVE-2019-5478 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Zu11Eg Firmware CVE-2019-5478

MEDIUM

Violation of Secure Design Principles (CWE-657)

2019-09-03 support@hackerone.com

Information Disclosure Zu11Eg Firmware Zu15Eg Firmware Zu17Eg Firmware Zu19Eg Firmware Zu1Cg Firmware Zu1Eg Firmware Zu21Dr Firmware Zu25Dr Firmware Zu27Dr Firmware Zu28Dr Firmware Zu29Dr Firmware Zu2Cg Firmware Zu2Eg Firmware Zu39Dr Firmware Zu3Cg Firmware Zu3Eg Firmware Zu3Tcg Firmware Zu3Teg Firmware Zu42Dr Firmware Zu43Dr Firmware Zu46Dr Firmware Zu47Dr Firmware Zu48Dr Firmware Zu49Dr Firmware Zu4Cg Firmware Zu4Eg Firmware Zu4Ev Firmware Zu5Cg Firmware Zu5Eg Firmware Zu5Ev Firmware Zu63Dr Firmware Zu64Dr Firmware Zu65Dr Firmware Zu67Dr Firmware Zu6Cg Firmware Zu6Eg Firmware Zu7Cg Firmware Zu7Eg Firmware Zu7Ev Firmware Zu9Cg Firmware Zu9Eg Firmware

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Sep 03, 2019 - 20:15 nvd

MEDIUM 5.5

DescriptionNVD

A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior.

AnalysisAI

A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-657. A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior. Affected products include: Amd Zu11Eg Firmware, Amd Zu15Eg Firmware, Amd Zu17Eg Firmware, Amd Zu19Eg Firmware, Amd Zu1Cg Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.