CVE-2023-51712
CVE-2023-51712 is a medium-severity vulnerability in Trustedfirmware Trusted Firmware-m with a CVSS 3.x base score of 4.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: Medium (CVSS 3.x base score 4.7)
- EPSS exploit prediction: 0% (21st percentile)
- Actively exploited: Not listed in CISA KEV
- EU (EUVD) id: EUVD-2023-56409
- Affected product: Trustedfirmware Trusted Firmware-m
- Published:
- Last modified:
Description
An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.
Frequently asked questions
- What is CVE-2023-51712?
- An issue was discovered in Trusted Firmware-M through 2.0.0. The lack of argument verification in the logging subsystem allows attackers to read sensitive data via the login function.
- How severe is CVE-2023-51712?
- CVE-2023-51712 has a CVSS 3.x base score of 4.7, rated medium severity. It is exploitable over physical access with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
- Is CVE-2023-51712 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (21st percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2023-51712?
- CVE-2023-51712 affects Trustedfirmware Trusted Firmware-m. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-51712?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- Does CVE-2023-51712 have an EU (EUVD) identifier?
- Yes. CVE-2023-51712 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-56409.
- When was CVE-2023-51712 published?
- CVE-2023-51712 was published on 2024-09-05 and last updated on 2026-06-17.
References
- https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/
- https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/debug_log_vulnerability.html
Affected products (1)
- cpe:2.3:o:trustedfirmware:trusted_firmware-m:*:*:*:*:*:*:*:*
More vulnerabilities in Trustedfirmware Trusted Firmware-m
- CVE-2021-43619 — High (CVSS 7.8): Trusted Firmware M 1.4.x through 1.4.1 has a buffer overflow issue in the Firmware Update partition. In the IPC model,…
- CVE-2023-40271 — High (CVSS 7.5): In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell…
- CVE-2021-32032 — High (CVSS 7.5): In Trusted Firmware-M through 1.3.0, cleaning up the memory allocated for a multi-part cryptographic operation (in the…
- CVE-2021-40327 — Medium (CVSS 5.9): Trusted Firmware-M (TF-M) 1.4.0, when Profile Small is used, has incorrect access control. NSPE can access a secure key…
- CVE-2021-27562 — Medium (CVSS 5.5): In Arm Trusted Firmware M through 1.2, the NS world may trigger a system halt, an overwrite of secure data, or the…