{"id":"CVE-2017-18347","aliases":["EUVD-2017-9472","GHSA-5f4r-g29m-jw8q"],"status":"published","title":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...","description":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.","severity":{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.004,"percentile":0.34531,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-362"],"published":"2018-09-12T15:00:00Z","modified":"2026-06-17T01:12:39Z","products":[{"vendor":"st","product":"stm32f030c6_firmware"},{"vendor":"st","product":"stm32f030c8_firmware"},{"vendor":"st","product":"stm32f030cc_firmware"},{"vendor":"st","product":"stm32f030f4_firmware"},{"vendor":"st","product":"stm32f030k6_firmware"},{"vendor":"st","product":"stm32f030r8_firmware"},{"vendor":"st","product":"stm32f030rc_firmware"},{"vendor":"st","product":"stm32f031c4_firmware"},{"vendor":"st","product":"stm32f031c6_firmware"},{"vendor":"st","product":"stm32f031e6_firmware"},{"vendor":"st","product":"stm32f031f4_firmware"},{"vendor":"st","product":"stm32f031f6_firmware"},{"vendor":"st","product":"stm32f031g4_firmware"},{"vendor":"st","product":"stm32f031g6_firmware"},{"vendor":"st","product":"stm32f031k4_firmware"},{"vendor":"st","product":"stm32f038c6_firmware"},{"vendor":"st","product":"stm32f038e6_firmware"},{"vendor":"st","product":"stm32f038f6_firmware"},{"vendor":"st","product":"stm32f038g6_firmware"},{"vendor":"st","product":"stm32f038k6_firmware"},{"vendor":"st","product":"stm32f042c4_firmware"},{"vendor":"st","product":"stm32f042c6_firmware"},{"vendor":"st","product":"stm32f042f4_firmware"},{"vendor":"st","product":"stm32f042f6_firmware"},{"vendor":"st","product":"stm32f042g4_firmware"},{"vendor":"st","product":"stm32f042g6_firmware"},{"vendor":"st","product":"stm32f042k4_firmware"},{"vendor":"st","product":"stm32f042k6_firmware"},{"vendor":"st","product":"stm32f042t6_firmware"},{"vendor":"st","product":"stm32f048c6_firmware"},{"vendor":"st","product":"stm32f048g6_firmware"},{"vendor":"st","product":"stm32f048t6_firmware"},{"vendor":"st","product":"stm32f051c4_firmware"},{"vendor":"st","product":"stm32f051c6_firmware"},{"vendor":"st","product":"stm32f051c8_firmware"},{"vendor":"st","product":"stm32f051k4_firmware"},{"vendor":"st","product":"stm32f051k6_firmware"},{"vendor":"st","product":"stm32f051k8_firmware"},{"vendor":"st","product":"stm32f051r4_firmware"},{"vendor":"st","product":"stm32f051r6_firmware"},{"vendor":"st","product":"stm32f051r8_firmware"},{"vendor":"st","product":"stm32f051t8_firmware"},{"vendor":"st","product":"stm32f058c8_firmware"},{"vendor":"st","product":"stm32f058r8_firmware"},{"vendor":"st","product":"stm32f058t8_firmware"},{"vendor":"st","product":"stm32f070c6_firmware"},{"vendor":"st","product":"stm32f070cb_firmware"},{"vendor":"st","product":"stm32f070f6_firmware"},{"vendor":"st","product":"stm32f070rb_firmware"},{"vendor":"st","product":"stm32f071c8_firmware"},{"vendor":"st","product":"stm32f071cb_firmware"},{"vendor":"st","product":"stm32f071rb_firmware"},{"vendor":"st","product":"stm32f071v8_firmware"},{"vendor":"st","product":"stm32f071vb_firmware"},{"vendor":"st","product":"stm32f072c8_firmware"},{"vendor":"st","product":"stm32f072cb_firmware"},{"vendor":"st","product":"stm32f072r8_firmware"},{"vendor":"st","product":"stm32f072rb_firmware"},{"vendor":"st","product":"stm32f072v8_firmware"},{"vendor":"st","product":"stm32f072vb_firmware"},{"vendor":"st","product":"stm32f078cb_firmware"},{"vendor":"st","product":"stm32f078rb_firmware"},{"vendor":"st","product":"stm32f078vb_firmware"},{"vendor":"st","product":"stm32f091cb_firmware"},{"vendor":"st","product":"stm32f091cc_firmware"},{"vendor":"st","product":"stm32f091rb_firmware"},{"vendor":"st","product":"stm32f091rc_firmware"},{"vendor":"st","product":"stm32f091vb_firmware"},{"vendor":"st","product":"stm32f091vc_firmware"},{"vendor":"st","product":"stm32f098cc_firmware"},{"vendor":"st","product":"stm32f098rc_firmware"},{"vendor":"st","product":"stm32f098vc_firmware"}],"references":[{"url":"https://community.st.com/s/question/0D50X00009Xke7aSAB/readout-protection-cracked-on-stm32","tags":["x_refsource_MISC","x_transferred","Vendor Advisory"]},{"url":"https://www.usenix.org/conference/woot17/workshop-program/presentation/obermaier","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://www.aisec.fraunhofer.de/en/FirmwareProtection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18347"},{"url":"https://github.com/advisories/GHSA-5f4r-g29m-jw8q"}],"sources":{"cve":[{"id":"CVE-2017-18347","description":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.","status":"published","published":"2018-09-12T15:00:00Z","modified":"2024-09-17T01:36:16.947Z","updated_at":"2026-11-02T14:33:21.747294Z"}],"euvd":[{"id":"EUVD-2017-9472","description":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.","status":"published","published":"2018-09-12T15:00:00Z","modified":"2024-09-17T01:36:16Z","updated_at":"2026-11-03T00:28:48.402396Z"}],"ghsa":[{"id":"GHSA-5f4r-g29m-jw8q","title":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows...","description":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.","status":"published","published":"2022-05-13T01:10:26Z","modified":"2023-02-01T05:03:30Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:50:03.88435Z"}],"nvd":[{"id":"CVE-2017-18347","description":"Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.","status":"published","published":"2018-09-12T15:29:00.233Z","modified":"2026-06-17T01:12:39.693Z","cvss":[{"version":"3.1","score":4.6,"vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:C/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-362"],"updated_at":"2026-11-02T14:04:19.545286Z"}]}}