What is the CVSS score of CVE-2020-20949?

CVE-2020-20949 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.9%.

Stm32Cubef0 CVE-2020-20949

MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2021-01-20 cve@mitre.org

Information Disclosure Oracle Stm32Cubef0 Stm32Cubef1 Stm32Cubef2 Stm32Cubef3 Stm32Cubef4 Stm32Cubef7 Stm32Cubeg0 Stm32Cubeg4 Stm32Cubeh7 Stm32Cubeide Stm32Cubel0 Stm32Cubel1 Stm32Cubel4 Stm32Cubel5 Stm32Cubemonitor Stm32Cubemp1 Stm32Cubemx Stm32Cubeprogrammer Stm32Cubewb Stm32Cubewl Public Key Cryptography Standards 1

5.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jan 20, 2021 - 16:15 nvd

MEDIUM 5.9

DescriptionNVD

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure.

AnalysisAI

Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-327. Bleichenbacher's attack on PKCS #1 v1.5 padding for RSA in STM32 cryptographic firmware library software expansion for STM32Cube (UM1924). The vulnerability can allow one to use Bleichenbacher's oracle attack to decrypt an encrypted ciphertext by making successive queries to the server using the vulnerable library, resulting in remote information disclosure. Affected products include: St Stm32Cubef0, St Stm32Cubef1, St Stm32Cubef2, St Stm32Cubef3, St Stm32Cubef4.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.