CVE-2017-18347
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...
CVE-2017-18347 is a medium vulnerability (CVSS 4.6) in St Stm32f030c6 Firmware, published September 12, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.
- Severity
- 4.6 MediumCVSS 3.1, NVD
- Exploit chance
- 0.40%EPSS, 34th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
Affected products
- st stm32f030c6 firmware
- st stm32f030c8 firmware
- st stm32f030cc firmware
- st stm32f030f4 firmware
- st stm32f030k6 firmware
- st stm32f030r8 firmware
- st stm32f030rc firmware
- st stm32f031c4 firmware
- st stm32f031c6 firmware
- st stm32f031e6 firmware
- st stm32f031f4 firmware
- st stm32f031f6 firmware
Show 60 moreShow less
- st stm32f031g4 firmware
- st stm32f031g6 firmware
- st stm32f031k4 firmware
- st stm32f038c6 firmware
- st stm32f038e6 firmware
- st stm32f038f6 firmware
- st stm32f038g6 firmware
- st stm32f038k6 firmware
- st stm32f042c4 firmware
- st stm32f042c6 firmware
- st stm32f042f4 firmware
- st stm32f042f6 firmware
- st stm32f042g4 firmware
- st stm32f042g6 firmware
- st stm32f042k4 firmware
- st stm32f042k6 firmware
- st stm32f042t6 firmware
- st stm32f048c6 firmware
- st stm32f048g6 firmware
- st stm32f048t6 firmware
- st stm32f051c4 firmware
- st stm32f051c6 firmware
- st stm32f051c8 firmware
- st stm32f051k4 firmware
- st stm32f051k6 firmware
- st stm32f051k8 firmware
- st stm32f051r4 firmware
- st stm32f051r6 firmware
- st stm32f051r8 firmware
- st stm32f051t8 firmware
- st stm32f058c8 firmware
- st stm32f058r8 firmware
- st stm32f058t8 firmware
- st stm32f070c6 firmware
- st stm32f070cb firmware
- st stm32f070f6 firmware
- st stm32f070rb firmware
- st stm32f071c8 firmware
- st stm32f071cb firmware
- st stm32f071rb firmware
- st stm32f071v8 firmware
- st stm32f071vb firmware
- st stm32f072c8 firmware
- st stm32f072cb firmware
- st stm32f072r8 firmware
- st stm32f072rb firmware
- st stm32f072v8 firmware
- st stm32f072vb firmware
- st stm32f078cb firmware
- st stm32f078rb firmware
- st stm32f078vb firmware
- st stm32f091cb firmware
- st stm32f091cc firmware
- st stm32f091rb firmware
- st stm32f091rc firmware
- st stm32f091vb firmware
- st stm32f091vc firmware
- st stm32f098cc firmware
- st stm32f098rc firmware
- st stm32f098vc firmware
What each source reports
NVD Score used
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
- Record
CVE-2017-18347- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:C/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
CVE ListNo score
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
- Record
CVE-2017-18347- Updated
- 2026-11-02
EUVDEUVD-2017-9472No score
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
- Record
EUVD-2017-9472- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5f4r-g29m-jw8q
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...
Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.
- Record
GHSA-5f4r-g29m-jw8q- CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-362
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.