CVSS: 6.8EPSS: 0%CPEs: 66EXPL: 0CVE-2023-35818
https://notcve.org/view.php?id=CVE-2023-35818
An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code. • https://espressif.com https://www.espressif.com/sites/default/files/advisory_downloads/AR2023-005%20Security%20Advisory%20Concerning%20Bypassing%20Secure%20Boot%20and%20Flash%20Encryption%20Using%20EMFI%20EN.pdf •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2022-24893 – Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption
https://notcve.org/view.php?id=CVE-2022-24893
ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be triggered during provisioning, because there is no check for the `SegN` field of the Transaction Start PDU. This can result in memory corruption related attacks and potentially attacker gaining control of the entire system. Patch commits are available on the 4.1, 4.2, 4.3 and 4.4 branches and users are recommended to upgrade. The upgrade is applicable for all applications and users of `ESP-BLE-MESH` component from `ESP-IDF`. • https://github.com/espressif/esp-idf/security/advisories/GHSA-7f7f-jj2q-28wm • CWE-787: Out-of-bounds Write CWE-788: Access of Memory Location After End of Buffer •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-41104 – web_server allows OTA update without checking user defined basic auth username & password
https://notcve.org/view.php?id=CVE-2021-41104
ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`. ESPHome es un sistema para controlar el ESP8266/ESP32. • https://github.com/esphome/esphome/pull/2409/commits/207cde1667d8c799a197b78ca8a5a14de8d5ca1e https://github.com/esphome/esphome/releases/tag/2021.9.2 https://github.com/esphome/esphome/security/advisories/GHSA-48mj-p7x2-5jfm • CWE-306: Missing Authentication for Critical Function •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2021-28135
https://notcve.org/view.php?id=CVE-2021-28135
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of continuous unsolicited LMP responses, allowing attackers in radio range to trigger a denial of service (crash) in ESP32 by flooding the target device with LMP Feature Response data. Una implementación de Bluetooth Classic en Espressif ESP-IDF versión 4.4 y anteriores, no maneja apropiadamente la recepción de respuestas LMP continuas no solicitadas, permitiendo a atacantes en el rango de radio desencadenar una denegación de servicio (caída) en ESP32 inundando el dispositivo de destino con datos de respuesta de características LMP • https://dl.packetstormsecurity.net/papers/general/braktooth.pdf https://github.com/espressif/esp-idf https://github.com/espressif/esp32-bt-lib https://www.espressif.com/en/products/socs/esp32 •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2021-28136
https://notcve.org/view.php?id=CVE-2021-28136
The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not properly handle the reception of multiple LMP IO Capability Request packets during the pairing process, allowing attackers in radio range to trigger memory corruption (and consequently a crash) in ESP32 via a replayed (duplicated) LMP packet. Una implementación de Bluetooth Classic en Espressif ESP-IDF versiones 4.4 y anteriores, no maneja apropiadamente la recepción de múltiples paquetes de petición de capacidad LMP IO durante el proceso de emparejamiento, permitiendo a atacantes en el rango de radio desencadenar una corrupción de la memoria (y en consecuencia un bloqueo) en el ESP32 por medio de un paquete LMP reproducido (duplicado) • https://dl.packetstormsecurity.net/papers/general/braktooth.pdf https://github.com/espressif/esp-idf https://github.com/espressif/esp32-bt-lib https://www.espressif.com/en/products/socs/esp32 • CWE-787: Out-of-bounds Write •