by Kastro CVE-2024-25077
renesas smartbond_da14695 — An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices.
Description · from the CVE record
An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The Nonce used for on-the-fly decryption of flash images is stored in an unsigned header, allowing its value to be modified without invalidating the signature used for secureboot image verification. Because the encryption engine for on-the-fly decryption uses AES in CTR mode without authentication, an attacker-modified Nonce can result in execution of arbitrary code.
Affected
ProductAffectedFixed inSource
n/an/a–CNA
smartbond_da14695da14695–CISA-ADP
smartbond_da14695da14691–CISA-ADP
smartbond_da14695da14697–CISA-ADP
smartbond_da14695da14699–CISA-ADP
Scores by source
CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total