CVE-2017-7932
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX...
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
- Record
CVE-2017-7932- CVSS 3.0
- 6.0 Medium
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - CVSS 2.0
- 4.4 Medium
AV:L/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
- Record
CVE-2017-7932- Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2017-16903 No score
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
- Record
EUVD-2017-16903- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-mm3w-pr4h-xqq8
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX...
An improper certificate validation issue was discovered in NXP i.MX 28 i.MX 50, i.MX 53, i.MX 7Solo i.MX 7Dual Vybrid VF3xx, Vybrid VF5xx, Vybrid VF6xx, i.MX 6ULL, i.MX 6UltraLite, i.MX 6SoloLite, i.MX 6Solo, i.MX 6DualLite, i.MX 6SoloX, i.MX 6Dual, i.MX 6Quad, i.MX 6DualPlus, and i.MX 6QuadPlus. When the device is configured in security enabled configuration, under certain conditions it is possible to bypass the signature verification by using a specially crafted certificate leading to the execution of an unsigned image.
- Record
GHSA-mm3w-pr4h-xqq8- CVSS 3.0
- 6.0 Medium
CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H - Weakness
- CWE-295
- Updated
- 2026-11-02
Affected products
- nxp i.mx 28 firmware
- nxp i.mx 50 firmware
- nxp i.mx 53 firmware
- nxp i.mx 6dual firmware
- nxp i.mx 6duallite firmware
- nxp i.mx 6dualplus firmware
- nxp i.mx 6quad firmware
- nxp i.mx 6quadplus firmware
- nxp i.mx 6solo firmware
- nxp i.mx 6sololite firmware
- nxp i.mx 6solox firmware
- nxp i.mx 6ull firmware
Show 18 moreShow less
- nxp i.mx 6ultralite firmware
- nxp i.mx 7dual firmware
- nxp i.mx 7solo firmware
- nxp vybrid mvf30nn151cku26 firmware
- nxp vybrid mvf30ns151cku26 firmware
- nxp vybrid mvf50nn151cmk40 firmware
- nxp vybrid mvf50nn151cmk50 firmware
- nxp vybrid mvf50ns151cmk40 firmware
- nxp vybrid mvf50ns151cmk50 firmware
- nxp vybrid mvf51nn151cmk50 firmware
- nxp vybrid mvf51ns151cmk50 firmware
- nxp vybrid mvf60nn151cmk40 firmware
- nxp vybrid mvf60nn151cmk50 firmware
- nxp vybrid mvf60ns151cmk40 firmware
- nxp vybrid mvf60ns151cmk50 firmware
- nxp vybrid mvf61nn151cmk50 firmware
- nxp vybrid mvf61ns151cmk50 firmware
- nxp vybrid mvf62nn151cmk40 firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-7932 is a medium vulnerability (CVSS 6.0) in Nxp I.mx 28 Firmware, published August 7, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.