Weakness (CWE)
CWE-1328: Security Version Number Mutable to Older Versions
The security version number in the hardware product is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.
How to prevent it (2 mitigations)
-
Architecture and Design
The security version number must be stored securely and persistently across power-on resets. When architecting the system, security version data should be designated for storage in registers that are either read-only or have access controls that prevent modification by an untrusted agent.
-
Implementation
During implementation and test, security version data should be demonstrated to be read-only and access controls should be validated.
Source: MITRE CWE-1328
2 results · Clear filters · Feed
-
Low 3.1
Dell Client Platform BIOS contains a Security Version Number Mutable to Older Versions vulnerability. A high privileged…
-
Low 1.8
Unauthenticated Firmware Downgrade in Bitdefender Box v1
An improper access control vulnerability exists in Bitdefender Box 1 (firmware version 1.3.52.928 and below) that allows an unauthenticated attacker to downgrade the device's firmware to an older, potentially vulnerable version of a Bitdefender-signed firmwar…