PT-2019-13515 · Arduino · Arduino

Joe Loughry · Published 2019-07-19 · Updated 2020-08-24 · CVE-2019-13991

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Arduino versions prior to Rev3

Description The issue allows remote attackers to send data to LEDs directly connected to GPIO pins via a laser, due to LED photosensitivity.

Recommendations For Arduino versions prior to Rev3, consider using alternative methods to control LEDs that are not susceptible to photosensitivity, or implement physical shielding to prevent external light sources from interfering with the LEDs.

Fix

Related Identifiers

CVE-2019-13991

Affected Products

Arduino

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-13991 · Security Note
• https://osv.dev/vulnerability/CVE-2019-13991 · Vendor Advisory
• https://arxiv.org/abs/1907.00479 · Note