CVE-2023-39902

Name: CVE-2023-39902
Creator: NVD / NIST
Published: 2023-10-17T12:15:09.96+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 7.8/10EPSS 0.14%

Last modified Jun 17, 2026

CVE-2023-39902 is a high-severity vulnerability rated 7.8/10 on the CVSS scale. A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. EPSS estimates a 0.14% chance of exploitation in the next 30 days.

Description

A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family processors. Under certain conditions, a crafted Flattened Image Tree (FIT) format structure can be used to overwrite SPL memory, allowing unauthenticated software to execute on the target, leading to privilege escalation. This affects i.MX 8M, i.MX 8M Mini, i.MX 8M Nano, and i.MX 8M Plus.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.14%

4.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-281

Affected Software

Vendor	Product	Versions
Nxp	Uboot Secondary Program Loader	< 2023.07

References

https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196Mitigation, Patch, Vendor Advisory
https://nxp.comProduct
https://community.nxp.com/t5/i-MX-Security/U-Boot-Secondary-Program-Loader-Authentication-Vulnerability-CVE/ta-p/1736196Mitigation, Patch, Vendor Advisory
https://nxp.comProduct

Timeline

Published: Oct 17, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-39902?

How severe is CVE-2023-39902?

CVE-2023-39902 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.14% probability of exploitation in the next 30 days.

How do I fix CVE-2023-39902?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-39902?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST