What is the CVSS score of CVE-2022-22819?

CVE-2022-22819 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.3%.

Is there a public PoC exploit available for CVE-2022-22819?

Yes, a public proof-of-concept exploit is available for CVE-2022-22819. Prioritise patching immediately. EPSS: 1.3%.

Lpc55S66Jbd64 Firmware CVE-2022-22819

HIGH

Classic Buffer Overflow (CWE-120)

2022-03-23 cve@mitre.org

RCE Buffer Overflow Lpc55S66Jbd64 Firmware Lpc55S66Jbd100 Firmware Lpc55S66Jev98 Firmware Lpc55S69Jbd64 Firmware Lpc55S69Jbd100 Firmware Lpc55S69Jev98 Firmware

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Mar 23, 2022 - 22:15 nvd

HIGH 7.8

DescriptionNVD

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.

AnalysisAI

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Buffer Copy without Size Check (CWE-120), which allows attackers to overflow a buffer to corrupt adjacent memory. NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update. Affected products include: Nxp Lpc55S66Jbd64 Firmware, Nxp Lpc55S66Jbd100 Firmware, Nxp Lpc55S66Jev98 Firmware, Nxp Lpc55S69Jbd64 Firmware, Nxp Lpc55S69Jbd100 Firmware. Version information: version 1.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Always validate buffer sizes before copy operations. Use bounded functions (strncpy, snprintf). Enable compiler protections.