PT-2022-14281 · Unknown · Preloader Xflash

Published 2022-02-09 · Updated 2022-02-11 · CVE-2022-20034

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Preloader XFLASH (affected versions not specified)

Description The issue is related to an improper certificate validation, which could lead to a local escalation of privilege. An attacker with physical access to the device can exploit this without needing additional execution privileges or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2022-20034

Affected Products

Preloader Xflash

References · 3

• https://corp.mediatek.com/product-security-bulletin/February-2022 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-20034 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-20034 · Security Note