CVE-2020-11684
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory...
CVE-2020-11684 is a critical vulnerability (CVSS 9.1) in Linux4sam At91bootstrap, published September 14, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. No source names a fixed version.
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
- Record
CVE-2020-11684- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 2.0
- 6.4 Medium
AV:N/AC:L/Au:N/C:P/I:P/A:N - Weakness
- CWE-212
- Updated
- 2026-11-02
CVE List No score
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
- Record
CVE-2020-11684- Updated
- 2026-11-02
EUVDEUVD-2020-4026 No score
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
- Record
EUVD-2020-4026- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-233h-674c-hxmw No score
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory...
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
- Record
GHSA-233h-674c-hxmw- Weakness
- CWE-326
- Updated
- 2026-11-02
OSV
AT91bootstrap before 3.9.2 does not properly wipe encryption and authentication keys from memory before passing control to a less privileged software component. This can be exploited to disclose these keys and subsequently encrypt and sign the next boot stage (such as the bootloader).
- Record
CVE-2020-11684- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
Affected products
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |