Espressif · Esp-Idf · CVE-2019-15894
**Name of the Vulnerable Software and Affected Versions**
Espressif ESP-IDF versions 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1
**Description**
An issue allows an attacker to bypass the Secure Boot digest verification at startup using fault injection to physically disrupt the ESP32 CPU, enabling the booting of unverified code from flash. The impact is minimized if the ESP32 is configured with both Secure Boot and Flash Encryption. However, without Flash Encryption, successful fault injection can lead to arbitrary code execution.
**Recommendations**
For versions 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1, to protect against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.