CVE-2023-35818

An issue was discovered on Espressif ESP32 3.0 (ESP32_rev300 ROM) devices. An EMFI attack on ECO3 provides the attacker with a capability to influence the PC value at the CPU context level, regardless of Secure Boot and Flash Encryption status. By using this capability, the attacker can exploit another behavior in the chip to gain unauthorized access to the ROM download mode. Access to ROM download mode may be further exploited to read the encrypted flash content in cleartext format or execute stub code.

• https://espressif.comProduct
• https://www.espressif.com/sites/default/files/advisory_downloads/AR2023-005%20Security%20Advisory%20Concerning%20Bypassing%20Secure%20Boot%20and%20Flash%20Encryption%20Using%20EMFI%20EN.pdfVendor Advisory
• https://espressif.comProduct
• https://www.espressif.com/sites/default/files/advisory_downloads/AR2023-005%20Security%20Advisory%20Concerning%20Bypassing%20Secure%20Boot%20and%20Flash%20Encryption%20Using%20EMFI%20EN.pdfVendor Advisory

Published

Jul 17, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-35812An issue was discovered in the Amazon Linux packages of Open…5.3
• CVE-2023-35813Multiple Sitecore products allow remote code execution. This…9.8
• CVE-2023-35814DevExpress before 23.1.3 does not properly protect XtraRepor…9.8
• CVE-2023-35815DevExpress before 23.1.3 has a data-source protection mechan…9.8
• CVE-2023-35816DevExpress before 23.1.3 allows arbitrary TypeConverter conv…5.3
• CVE-2023-35817DevExpress before 23.1.3 allows AsyncDownloader SSRF.9.8
• CVE-2023-3582Mattermost fails to verify channel membership when linking a…4.3
• CVE-2023-35823An issue was discovered in the Linux kernel before 6.3.2. A …7
• CVE-2023-35824An issue was discovered in the Linux kernel before 6.3.2. A …7
• CVE-2023-35825Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-35826An issue was discovered in the Linux kernel before 6.3.2. A …7
• CVE-2023-35827An issue was discovered in the Linux kernel through 6.3.8. A…7