Weakness (CWE)
CWE-1328: Security Version Number Mutable to Older Versions
The security version number in the hardware product is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
How to prevent it (2 mitigations)
-
Architecture and Design
The security version number must be stored securely and persistently across power-on resets. When architecting the system, security version data should be designated for storage in registers that are either read-only or have access controls that prevent modification by an untrusted agent.
-
Implementation
During implementation and test, security version data should be demonstrated to be read-only and access controls should be validated.
Source: MITRE CWE-1328
6 results · Feed
-
Medium 6.6
Dell ThinOS 10, versions prior to 2605_10.2616, contain a Security Version Number Mutable to Older Versions vulnerabili…
-
Medium 6.8
Tesla Wall Connector Firmware Downgrade Vulnerability
Tesla Wall Connector Firmware Downgrade Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Tesla Wall Connector devices. Authentication is not required to exploit this vulnerability. Th…
-
High 7.5
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability
Autel MaxiCharger AC Wallbox Commercial Firmware Downgrade Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Autel MaxiCharger AC Wallbox Commercial charging statio…
-
Low 3.1
Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged…
-
Low 1.8
Unauthenticated Firmware Downgrade in Bitdefender Box v1
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmwar…
-
Medium 4.3
A firmware downgrade prevention vulnerability has been identified in newer Lexmark devices.
A new feature to prevent Firmware downgrades was recently added to some Lexmark products. A method to override this downgrade protection has been identified.