CVE-2021-32015

{"id": "CVE-2021-32015", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.6, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 0.8}]}, "published": "2021-06-08T17:15:07.720", "references": [{"url": "https://www.nuvoton.com/support/product-related-information/security-advisories/sa-001/", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update."}, {"lang": "es", "value": "En Nuvoton NPCT75x TPM versi\u00f3n 1.2 versi\u00f3n de firmware 7.4.0.0, un usuario local malicioso y autenticado muy privilegiado podr\u00eda potencialmente conseguir acceso no autorizado a la memoria no vol\u00e1til del TPM. NOTA: actualizando a versi\u00f3n de firmware 7.4.0.1 mitigar\u00e1 la vulnerabilidad, pero versi\u00f3n 7.4.0.1 no est\u00e1 certificada por TCG o Common Criteria (CC). Nuvoton recomienda que los usuarios apliquen la actualizaci\u00f3n de firmware NPCT75x TPM 1.2"}], "lastModified": "2021-06-21T19:27:00.697", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:nuvoton:npct75x_firmware:7.4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19BF38D2-DADC-49F6-89E8-BA1C067D60E8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nuvoton:npct75x:1.2:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "C0A204DC-91B8-4326-AE7B-1E8289C741E5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}