PT-2026-4754 · Stmicroelectronics · Stm32

Published 2026-01-26 · Updated 2026-01-26 · CVE-2025-59104

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Versions (affected versions not specified)

Description An attacker with physical access and sufficient time can solder test leads to the debug footprint or use a 6-Pin tag-connect cable to access the bootloader. This allows modification of the kernel command line, ultimately granting a root shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1234

Related Identifiers

CVE-2025-59104

Affected Products

Stm32

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-59104 · Security Note
• https://dormakabagroup.com/en/security-advisories · Vendor Advisory
• https://r.sec-consult.com/dkaccess · Note
• https://twitter.com/CVEnew/status/2015733300124627372 · Twitter Post
• https://r.sec-consult.com/dormakaba · Note
• https://twitter.com/VulmonFeeds/status/2015749336227869170 · Twitter Post
• https://t.me/CVEtracker/43006 · Telegram Post