Strix
26.1K

CVE-2021-31532

MEDIUMCVSS 6.8/10EPSS 0.45%

Last modified

CVE-2021-31532 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B), LPC55S1x, LPC551x (silicon rev 0A) and LPC55S0x, LPC550x (silicon rev 0A) include an undocumented ROM patch peripheral that allows unsigned, non-persistent modification of the internal ROM.. EPSS estimates a 0.45% chance of exploitation in the next 30 days.

Description

NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B), LPC55S1x, LPC551x (silicon rev 0A) and LPC55S0x, LPC550x (silicon rev 0A) include an undocumented ROM patch peripheral that allows unsigned, non-persistent modification of the internal ROM.

Metrics

CVSS 3.1
6.8/10

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.45%

36.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
NxpLpc55s69jbd100 FirmwareAll versions
NxpLpc55s66jbd100 FirmwareAll versions
NxpLpc55s69jev98 FirmwareAll versions
NxpLpcs66jev98 FirmwareAll versions
NxpLpc55s69jbd64 FirmwareAll versions
NxpLpcs66jbd64 FirmwareAll versions
NxpI.Mx Rt500 FirmwareAll versions
NxpI.Mx Rt600 FirmwareAll versions
NxpLpc55s28 FirmwareAll versions
NxpLpc55s26 FirmwareAll versions
NxpLpc5528 FirmwareAll versions
NxpLpc5526 FirmwareAll versions
NxpLpc55s16jbd100 FirmwareAll versions
NxpLpc55s16jev98 FirmwareAll versions
NxpLpc55s16jbd64 FirmwareAll versions
NxpLpc55s14jbd100 FirmwareAll versions
NxpLpc55s14jbd64 FirmwareAll versions
NxpLpc5516jbd100 FirmwareAll versions
NxpLpc5516jev98 FirmwareAll versions
NxpLpc5516jbd64 FirmwareAll versions
NxpLpc5514jbd100 FirmwareAll versions
NxpLpc5514jbd64 FirmwareAll versions
NxpLpc5512jbd100 FirmwareAll versions
NxpLpc5512jbd64 FirmwareAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2021-31532?
NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B), LPC55S1x, LPC551x (silicon rev 0A) and LPC55S0x, LPC550x (silicon rev 0A) include an undocumented ROM patch peripheral that allows unsigned, non-persistent modification of the internal ROM.
How severe is CVE-2021-31532?
CVE-2021-31532 has a CVSS score of 6.8/10 (MEDIUM severity). The EPSS model estimates a 0.45% probability of exploitation in the next 30 days.
How do I fix CVE-2021-31532?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-31532?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST