Description
Nuvoton - CWE-305: Authentication Bypass by Primary Weakness
An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock
reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code
execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Nuvoton | NPCM7xx (Poleg) BootBlock | All versions – < v10.10.19 | v10.10.19 |
Advisories 1
- WID-SEC-2024-1437 Dell integrated Dell Remote Access Controller: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 7, 2025