CVE-2023-50096

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-50096
STMicroelectronics STSAFE-A1xx middleware before 3.3.7 allows MCU code execution if an adversary has the ability to read from and write to the I2C bus. This is caused by an StSafeA_ReceiveBytes buffer overflow in the X-CUBE-SAFEA1 Software Package for STSAFE-A sample applications (1.2.0), and thus can affect user-written code that was derived from a published sample application.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.6 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:st:x-cube-safea1:1.2.0:*:*:*:*:stsafe-a:*:*
History

09 Jan 2024, 18:29

Type Values Removed Values Added
First Time St x-cube-safea1
St
CPE cpe:2.3:a:st:x-cube-safea1:1.2.0:*:*:*:*:stsafe-a:*:*
References () https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md - () https://github.com/elttam/publications/blob/master/writeups/CVE-2023-50096.md - Exploit, Third Party Advisory
CWE CWE-120
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

02 Jan 2024, 13:47

Type Values Removed Values Added
Summary
  • (es) El middleware STMicroelectronics STSAFE-A1xx anterior a 3.3.7 permite la ejecución de código MCU si un adversario tiene la capacidad de leer y escribir en el bus I2C. Esto se debe a un desbordamiento de búfer StSafeA_ReceiveBytes en el paquete de software X-CUBE-SAFEA1 para aplicaciones de muestra STSAFE-A (1.2.0) y, por lo tanto, puede afectar el código escrito por el usuario que se derivó de una aplicación de muestra publicada.

01 Jan 2024, 18:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-01-01 18:15

Updated : 2024-01-09 18:29

NVD link : CVE-2023-50096

Mitre link : CVE-2023-50096

CVE.ORG link : CVE-2023-50096

JSON object : View

Products Affected

st

  • x-cube-safea1
CWE
CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')