CVE Feed

    Dashboard / CVE / CVE-2020-27212

    CVE-2020-27212

    STMicroelectronics STM32L4 devices through 2020-10-19 have incorrect access control. The flash read-out protection (RDP) can be degraded from RDP level 2 (no access via debug interface) to level 1 (limited access via debug interface) by injecting a fault during the boot phase.

    Published:May 21, 2021
    Last Modified:Nov 21, 2024
    EPS:May 21, 2021
    EPSS Score:0.00095
    CVSS Score:7

    Affected Products

    Vendor
    St
    Product
    Stm32cubel4 Firmware
    Vendor
    St
    Product
    Stm32l412c8
    Vendor
    St
    Product
    Stm32l412cb
    Vendor
    St
    Product
    Stm32l412k8
    Vendor
    St
    Product
    Stm32l412kb
    Vendor
    St
    Product
    Stm32l412r8
    Vendor
    St
    Product
    Stm32l412rb
    Vendor
    St
    Product
    Stm32l412t8
    Vendor
    St
    Product
    Stm32l412tb
    Vendor
    St
    Product
    Stm32l422cb
    Vendor
    St
    Product
    Stm32l422kb
    Vendor
    St
    Product
    Stm32l422rb
    Vendor
    St
    Product
    Stm32l422tb
    Vendor
    St
    Product
    Stm32l431cb
    Vendor
    St
    Product
    Stm32l431cc
    Vendor
    St
    Product
    Stm32l431kb
    Vendor
    St
    Product
    Stm32l431kc
    Vendor
    St
    Product
    Stm32l431rb
    Vendor
    St
    Product
    Stm32l431rc
    Vendor
    St
    Product
    Stm32l431vc
    Vendor
    St
    Product
    Stm32l432kb
    Vendor
    St
    Product
    Stm32l432kc
    Vendor
    St
    Product
    Stm32l433cb
    Vendor
    St
    Product
    Stm32l433cc
    Vendor
    St
    Product
    Stm32l433rb
    Vendor
    St
    Product
    Stm32l433rc
    Vendor
    St
    Product
    Stm32l433vc
    Vendor
    St
    Product
    Stm32l442kc
    Vendor
    St
    Product
    Stm32l443cc
    Vendor
    St
    Product
    Stm32l443rc
    Vendor
    St
    Product
    Stm32l443vc
    Vendor
    St
    Product
    Stm32l451cc
    Vendor
    St
    Product
    Stm32l451ce
    Vendor
    St
    Product
    Stm32l451rc
    Vendor
    St
    Product
    Stm32l451re
    Vendor
    St
    Product
    Stm32l451vc
    Vendor
    St
    Product
    Stm32l451ve
    Vendor
    St
    Product
    Stm32l452cc
    Vendor
    St
    Product
    Stm32l452ce
    Vendor
    St
    Product
    Stm32l452rc
    Vendor
    St
    Product
    Stm32l452re
    Vendor
    St
    Product
    Stm32l452vc
    Vendor
    St
    Product
    Stm32l452ve
    Vendor
    St
    Product
    Stm32l462ce
    Vendor
    St
    Product
    Stm32l462re
    Vendor
    St
    Product
    Stm32l462ve
    Vendor
    St
    Product
    Stm32l471qe
    Vendor
    St
    Product
    Stm32l471qg
    Vendor
    St
    Product
    Stm32l471re
    Vendor
    St
    Product
    Stm32l471rg
    Vendor
    St
    Product
    Stm32l471ve
    Vendor
    St
    Product
    Stm32l471vg
    Vendor
    St
    Product
    Stm32l471ze
    Vendor
    St
    Product
    Stm32l471zg
    Vendor
    St
    Product
    Stm32l475rc
    Vendor
    St
    Product
    Stm32l475re
    Vendor
    St
    Product
    Stm32l475rg
    Vendor
    St
    Product
    Stm32l475vc
    Vendor
    St
    Product
    Stm32l475ve
    Vendor
    St
    Product
    Stm32l475vg
    Vendor
    St
    Product
    Stm32l476je
    Vendor
    St
    Product
    Stm32l476jg
    Vendor
    St
    Product
    Stm32l476me
    Vendor
    St
    Product
    Stm32l476mg
    Vendor
    St
    Product
    Stm32l476qe
    Vendor
    St
    Product
    Stm32l476qg
    Vendor
    St
    Product
    Stm32l476rc
    Vendor
    St
    Product
    Stm32l476re
    Vendor
    St
    Product
    Stm32l476rg
    Vendor
    St
    Product
    Stm32l476vc
    Vendor
    St
    Product
    Stm32l476ve
    Vendor
    St
    Product
    Stm32l476vg
    Vendor
    St
    Product
    Stm32l476ze
    Vendor
    St
    Product
    Stm32l476zg
    Vendor
    St
    Product
    Stm32l486jg
    Vendor
    St
    Product
    Stm32l486qg
    Vendor
    St
    Product
    Stm32l486rg
    Vendor
    St
    Product
    Stm32l486vg
    Vendor
    St
    Product
    Stm32l486zg
    Vendor
    St
    Product
    Stm32l496ae
    Vendor
    St
    Product
    Stm32l496ag
    Vendor
    St
    Product
    Stm32l496qe
    Vendor
    St
    Product
    Stm32l496qg
    Vendor
    St
    Product
    Stm32l496re
    Vendor
    St
    Product
    Stm32l496rg
    Vendor
    St
    Product
    Stm32l496ve
    Vendor
    St
    Product
    Stm32l496vg
    Vendor
    St
    Product
    Stm32l496wg
    Vendor
    St
    Product
    Stm32l496ze
    Vendor
    St
    Product
    Stm32l496zg
    Vendor
    St
    Product
    Stm32l4a6ag
    Vendor
    St
    Product
    Stm32l4a6qg
    Vendor
    St
    Product
    Stm32l4a6rg
    Vendor
    St
    Product
    Stm32l4a6vg
    Vendor
    St
    Product
    Stm32l4a6zg

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-10 Buffer Overflow via Environment Variables
    CAPEC-101 Server Side Include (SSI) Injection
    CAPEC-105 HTTP Request Splitting
    CAPEC-108 Command Line Execution through SQL Injection
    CAPEC-120 Double Encoding
    CAPEC-13 Subverting Environment Variable Values
    CAPEC-135 Format String Injection
    CAPEC-14 Client-side Injection-induced Buffer Overflow
    CAPEC-24 Filter Failure through Buffer Overflow
    CAPEC-250 XML Injection
    CAPEC-267 Leverage Alternate Encoding
    CAPEC-273 HTTP Response Smuggling
    CAPEC-28 Fuzzing
    CAPEC-3 Using Leading 'Ghost' Character Sequences to Bypass Input Filters
    CAPEC-34 HTTP Response Splitting
    CAPEC-42 MIME Conversion
    CAPEC-43 Exploiting Multiple Input Interpretation Layers
    CAPEC-45 Buffer Overflow via Symbolic Links
    CAPEC-46 Overflow Variables and Tags
    CAPEC-47 Buffer Overflow via Parameter Expansion
    CAPEC-51 Poison Web Service Registry
    CAPEC-52 Embedding NULL Bytes
    CAPEC-53 Postfix, Null Terminate, and Backslash
    CAPEC-6 Argument Injection
    CAPEC-64 Using Slashes and URL Encoding Combined to Bypass Validation Logic
    CAPEC-67 String Format Overflow in syslog()
    CAPEC-7 Blind SQL Injection
    CAPEC-71 Using Unicode Encoding to Bypass Validation Logic
    CAPEC-72 URL Encoding
    CAPEC-76 Manipulating Web Input to File System Calls
    CAPEC-78 Using Escaped Slashes in Alternate Encoding
    CAPEC-79 Using Slashes in Alternate Encoding
    CAPEC-8 Buffer Overflow in an API Call
    CAPEC-80 Using UTF-8 Encoding to Bypass Validation Logic
    CAPEC-83 XPath Injection
    CAPEC-84 XQuery Injection
    CAPEC-9 Buffer Overflow in Local Command-Line Utilities

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High