CVE-2022-22819

NXP LPC55S66JBD64, LPC55S66JBD100, LPC55S66JEV98, LPC55S69JBD64, LPC55S69JBD100, and LPC55S69JEV98 microcontrollers (ROM version 1B) have a buffer overflow in parsing SB2 updates before the signature is verified. This can allow an attacker to achieve non-persistent code execution via a crafted unsigned update.

CVSS v3.1

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0

6.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P

EPSS

1.40% chance of exploitation in the next 30 days, 71th percentile

Published

2022-03-23

Updated

2024-08-03

Proof-of-concept exploits (1)

• https://oxide.computer/blog/another-vulnerability-in-the-lpc55s69-rom

References

• CVE Record
• NVD entry

Related

• CVE-2022-22818
• CVE-2022-22822
• CVE-2022-22814
• CVE-2022-22827
• CVE-2022-2279
• CVE-2022-22828