CVE-2024-4760

MEDIUM

Improper Protection Against Voltage and Clock Glitches (CWE-1247)

2024-05-16 dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Information Disclosure

6.3

CVSS 3.1 · Vendor: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

Severity by source

Vendor (dc3f6da9-85b5-4a73-84a2-2ec90b40fca5) PRIMARY

6.3 MEDIUM

AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from Vendor (dc3f6da9-85b5-4a73-84a2-2ec90b40fca5) · only source for this CVE.

CVSS VectorVendor: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

May 16, 2024 - 13:15 cve.org

MEDIUM 6.3

DescriptionCVE.org

A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

AnalysisAI

Technical ContextAI

This vulnerability is classified under CWE-1247. A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.