CVE-2023-35818 - Vulnerability Details

An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0013.

Exploitation none

Automatable no

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:espressif:esp32-d0wd-v3_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-d0wd-v3_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-d0wd-v3:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

OR	cpe:2.3:o:espressif:esp32-d0wdr2-v3_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-d0wdr2-v3_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-d0wdr2-v3:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

OR	cpe:2.3:o:espressif:esp32-u4wdh_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-u4wdh_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-u4wdh:-:*:*:*:*:*:*:*

Configuration 4 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-v3_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-v3_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-v3:-:*:*:*:*:*:*:*

Configuration 5 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-v3-02_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-v3-02_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-v3-02:-:*:*:*:*:*:*:*

Configuration 6 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-d4_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-d4_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-d4:-:*:*:*:*:*:*:*

Configuration 7 [-]

AND

OR	cpe:2.3:o:espressif:esp32-wroom-32e_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-wroom-32e_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-wroom-32e:-:*:*:*:*:*:*:*

Configuration 8 [-]

AND

OR	cpe:2.3:o:espressif:esp32-wroom-32ue_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-wroom-32ue_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-wroom-32ue:-:*:*:*:*:*:*:*

Configuration 9 [-]

AND

OR	cpe:2.3:o:espressif:esp32-wroom-da_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-wroom-da_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-wroom-da:-:*:*:*:*:*:*:*

Configuration 10 [-]

AND

OR	cpe:2.3:o:espressif:esp32-wrover-e_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-wrover-e_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-wrover-e:-:*:*:*:*:*:*:*

Configuration 11 [-]

AND

OR	cpe:2.3:o:espressif:esp32-wrover-ie_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-wrover-ie_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-wrover-ie:-:*:*:*:*:*:*:*

Configuration 12 [-]

AND

OR	cpe:2.3:o:espressif:esp32-mini-1_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-mini-1_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-mini-1:-:*:*:*:*:*:*:*

Configuration 13 [-]

AND

OR	cpe:2.3:o:espressif:esp32-mini-1u_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-mini-1u_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-mini-1u:-:*:*:*:*:*:*:*

Configuration 14 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-mini-02_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-mini-02_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-mini-02:-:*:*:*:*:*:*:*

Configuration 15 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-mini-02u_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-mini-02u_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-mini-02u:-:*:*:*:*:*:*:*

Configuration 16 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-v3-zero_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-v3-zero_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-v3-zero:-:*:*:*:*:*:*:*

Configuration 17 [-]

AND

OR	cpe:2.3:o:espressif:esp32-devkitc_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-devkitc_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-devkitc:-:*:*:*:*:*:*:*

Configuration 18 [-]

AND

OR	cpe:2.3:o:espressif:esp32-devkitm-1_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-devkitm-1_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-devkitm-1:-:*:*:*:*:*:*:*

Configuration 19 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-kit_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-kit_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-kit:-:*:*:*:*:*:*:*

Configuration 20 [-]

AND

OR	cpe:2.3:o:espressif:esp32-pico-v3-zero-devkit_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-pico-v3-zero-devkit_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-pico-v3-zero-devkit:-:*:*:*:*:*:*:*

Configuration 21 [-]

AND

OR	cpe:2.3:o:espressif:esp-eye_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp-eye_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp-eye:-:*:*:*:*:*:*:*

Configuration 22 [-]

AND

OR	cpe:2.3:o:espressif:esp32-vaquita-dspg_firmware:3.0:::::::*
	cpe:2.3:o:espressif:esp32-vaquita-dspg_firmware:3.1:::::::*

cpe:2.3:h:espressif:esp32-vaquita-dspg:-:*:*:*:*:*:*:*

No data.

Project Subscriptions

Vendors	Products
Espressif Subscribe	Esp-eye Subscribe Esp-eye Firmware Subscribe Esp32-d0wd-v3 Subscribe Esp32-d0wd-v3 Firmware Subscribe Esp32-d0wdr2-v3 Subscribe Esp32-d0wdr2-v3 Firmware Subscribe Esp32-devkitc Subscribe Esp32-devkitc Firmware Subscribe Esp32-devkitm-1 Subscribe Esp32-devkitm-1 Firmware Subscribe Esp32-mini-1 Subscribe Esp32-mini-1 Firmware Subscribe Esp32-mini-1u Subscribe Esp32-mini-1u Firmware Subscribe Esp32-pico-d4 Subscribe Esp32-pico-d4 Firmware Subscribe Esp32-pico-kit Subscribe Esp32-pico-kit Firmware Subscribe Esp32-pico-mini-02 Subscribe Esp32-pico-mini-02 Firmware Subscribe Esp32-pico-mini-02u Subscribe Esp32-pico-mini-02u Firmware Subscribe Esp32-pico-v3 Subscribe Esp32-pico-v3-02 Subscribe Esp32-pico-v3-02 Firmware Subscribe Esp32-pico-v3-zero Subscribe Esp32-pico-v3-zero-devkit Subscribe Esp32-pico-v3-zero-devkit Firmware Subscribe Esp32-pico-v3-zero Firmware Subscribe Esp32-pico-v3 Firmware Subscribe Esp32-u4wdh Subscribe Esp32-u4wdh Firmware Subscribe Esp32-vaquita-dspg Subscribe Esp32-vaquita-dspg Firmware Subscribe Esp32-wroom-32e Subscribe Esp32-wroom-32e Firmware Subscribe Esp32-wroom-32ue Subscribe Esp32-wroom-32ue Firmware Subscribe Esp32-wroom-da Subscribe Esp32-wroom-da Firmware Subscribe Esp32-wrover-e Subscribe Esp32-wrover-e Firmware Subscribe Esp32-wrover-ie Subscribe Esp32-wrover-ie Firmware Subscribe

Advisories

Source	ID	Title
EUVD	EUVD-2023-39813	An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://espressif.com
https://www.espressif.com/sites/default/files/advisory_downloads/AR2023-005%20Security%20Advisory%20Concerning%20Bypassing%20Secure%20Boot%20and%20Flash%20Encryption%20Using%20EMFI%20EN.pdf

History

Thu, 31 Oct 2024 16:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-07-17T00:00:00

Updated: 2024-10-31T15:25:01.252Z

Reserved: 2023-06-17T00:00:00

Link: CVE-2023-35818

Vulnrichment

Updated: 2024-08-02T16:30:45.370Z

NVD

Status : Modified

Published: 2023-07-17T16:15:09.940

Modified: 2024-11-21T08:08:45.653

Link: CVE-2023-35818

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

NVD-CWE-noinfo

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Project Subscriptions

Projects

JSON object

JSON object

JSON object

JSON object

JSON object