What is the CVSS score of CVE-2022-45163?

CVE-2022-45163 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.6%.

Is there a public PoC exploit available for CVE-2022-45163?

Yes, a public proof-of-concept exploit is available for CVE-2022-45163. Prioritise patching immediately. EPSS: 0.6%.

I Mx 6 Firmware CVE-2022-45163

MEDIUM

Observable Discrepancy (CWE-203)

2022-11-18 cve@mitre.org

Information Disclosure I Mx 6 Firmware I Mx 6Dual Firmware I Mx 6Duallite Firmware I Mx 6Dualplus Firmware I Mx 6Quad Firmware I Mx 6Quadplus Firmware I Mx 6Solo Firmware I Mx 6Sololite Firmware I Mx 6Solox Firmware I Mx 6Ull Firmware I Mx 6Ultralite Firmware I Mx 6Ulz Firmware I Mx 7Dual Firmware I Mx 7Solo Firmware I Mx 7Ulp Firmware I Mx 8M Mini Firmware I Mx 8M Quad Firmware I Mx 8M Vybrid Firmware I Mx Rt1010 Firmware I Mx Rt1015 Firmware I Mx Rt1020 Firmware I Mx Rt1050 Firmware I Mx Rt1060 Firmware

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Nov 18, 2022 - 23:15 nvd

MEDIUM 4.6

DescriptionNVD

An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device security-enabled configuration, memory contents could potentially leak to physically proximate attackers via the respective SDP port in cold and warm boot attacks. (The recommended mitigation is to completely disable the SDP mode by programming a one-time programmable eFUSE. Customers can contact NXP for additional information.)

AnalysisAI

An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-203. An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX RT 1020, i.MX RT 1050, i.MX RT 1060, i.MX 6 Family, i.MX 7Dual/Solo, i.MX 7ULP, i.MX 8M Quad, i.MX 8M Mini, and Vybrid. In a device security-enabled configuration, memory contents could potentially leak to physically proximate attackers via the respective SDP port in cold and warm boot attacks. (The recommended mitigation is to completely disable the SDP mode by programming a one-time programmable eFUSE. Customers can contact NXP for additional information.) Affected products include: Nxp I.Mx 6 Firmware, Nxp I.Mx 6Dual Firmware, Nxp I.Mx 6Duallite Firmware, Nxp I.Mx 6Dualplus Firmware, Nxp I.Mx 6Quad Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.