CVE-2017-18347

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...

4.6 Medium

CVE-2017-18347 is a medium vulnerability (CVSS 4.6) in St Stm32f030c6 Firmware, published September 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.

Attack profile

How easy it is to exploit

Attack vector: Physical
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.40%Down 0.4 points since Apr 14, 2021

What each source reports

NVD Score used 4.6

Record: CVE-2017-18347
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 4.9 MediumAV:L/AC:L/Au:N/C:C/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

CVE List No score

Record: CVE-2017-18347
Updated: 2026-11-02

EUVDEUVD-2017-9472 No score

Record: EUVD-2017-9472
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5f4r-g29m-jw8q 4.6

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...

Record: GHSA-5f4r-g29m-jw8q
CVSS 3.1: 4.6 MediumCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-362
Updated: 2026-11-02

Affected products

Show 60 moreShow less

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD