EUVD-2026-72297
GHSA-j59p-mqmr-fcgh
Severity by source
AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Adjacent vector and high complexity reflect OTA-channel proximity requirement and slot-misalignment precondition; C:H/I:H/A:H reflect full radio co-processor code execution impact.
Primary rating from Vendor (30a5e7fb-040d-440a-8cdf-a4a2068ce72e).
CVSS VectorVendor: 30a5e7fb-040d-440a-8cdf-a4a2068ce72e
Lifecycle Timeline
4DescriptionCVE.org
When using the Direct XIP update strategy, the main application image starts other cores (i.e. radio core), based on the currently active slot without additional verification. The MCUboot in the bare (upstream) configuration assumes that if there is at least a single slot for each image available, the system is bootable and continues the boot process. This may lead to a situation when MCUboot picks different slot for different images (i.e. (a) for the main application and (b) for the radio image), boots the main application (from slot (a)) that afterwards starts the radio image by providing an address of the unauthenticated slot ((a) instead of (b)).
AnalysisAI
Signature verification bypass in MCUboot's Direct XIP multi-image boot sequence allows an adjacent unauthenticated attacker to cause a radio co-processor to execute from an unauthenticated firmware slot. When the main application image and radio image reside in mismatched active slots, MCUboot's bare/upstream configuration lacks cross-image slot consistency enforcement - the main application passes the wrong slot address to the radio core, which then executes unverified firmware. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following concurrent conditions: (1) MCUboot is configured in its bare/upstream mode using the Direct XIP update strategy - not the copy-based update strategy; (2) the target device is a multi-core system where the main application is responsible for starting a secondary processor such as a radio or network co-processor; (3) at least two image slots exist per core image (as required by Direct XIP); (4) an attacker can influence which firmware image occupies a given slot, most plausibly via adjacent-network access to an OTA update channel or a MITM position on unencrypted update traffic. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately reflects a constrained but high-impact threat: adjacent-network attack vector and high complexity appropriately require both proximity or OTA delivery capability and deliberate engineering of a slot-misalignment condition. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Consult the Nordic Semiconductor security advisory directly at https://docs.nordicsemi.com/r/bundle/struct_sa/page/struct/sa.html for the vendor-confirmed patched MCUboot version and associated SDK release. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all deployed systems using MCUboot Direct XIP with separate application and radio firmware images to scope exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today