{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-21T02:18:06.873","vulnerabilities":[{"cve":{"id":"CVE-2018-3968","sourceIdentifier":"talos-cna@cisco.com","published":"2019-03-21T17:29:00.493","lastModified":"2024-11-21T04:06:24.257","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"An exploitable vulnerability exists in the verified boot protection of the Das U-Boot from version 2013.07-rc1 to 2014.07-rc2. The affected versions lack proper FIT signature enforcement, which allows an attacker to bypass U-Boot's verified boot and execute an unsigned kernel, embedded in a legacy image format. To trigger this vulnerability, a local attacker needs to be able to supply the image to boot."},{"lang":"es","value":"Existe una vulnerabilidad explotable en la protección verificada de arranque de Das U-Boot, desde la versión 2013.07-rc1 hasta la 2014.07-rc2. Las versiones afectadas carecen de una aplicación adecuada de las firmas FIT, lo que permite que un atacante omita el arranque verificado de U-Boot y ejecute un kernel sin firmar, embebido en un formato de imagen heredado. Para desencadenar esta vulnerabilidad, un atacante local necesita ser capaz de proporcionar la imagen de arranque."}],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.0,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.0,"impactScore":5.9}],"cvssMetricV30":[{"source":"talos-cna@cisco.com","type":"Secondary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","baseScore":8.2,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.5,"impactScore":6.0}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:L/AC:M/Au:N/C:P/I:P/A:P","baseScore":4.4,"accessVector":"LOCAL","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":3.4,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}]},"weaknesses":[{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-347"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:*:*:*:*:*:*:*:*","versionStartIncluding":"2013.07","versionEndIncluding":"2014.07","matchCriteriaId":"1C8DB5B6-2A9F-44EA-B3DC-CDE840C14540"},{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:2013.07:rc1:*:*:*:*:*:*","matchCriteriaId":"6C787638-BDD7-485A-B024-803B9651D54A"},{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:2013.07:rc2:*:*:*:*:*:*","matchCriteriaId":"CD7B4F31-7C15-4EF6-9E09-923C0A396415"},{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:2013.07:rc3:*:*:*:*:*:*","matchCriteriaId":"B6179563-B4D6-4521-B7D3-89A2A8EC48A7"},{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:2014.07:rc1:*:*:*:*:*:*","matchCriteriaId":"9356F059-9AE8-4A34-9B94-7690E068F212"},{"vulnerable":true,"criteria":"cpe:2.3:a:denx:u-boot:2014.07:rc2:*:*:*:*:*:*","matchCriteriaId":"D588DDD7-46D5-4BFF-9732-DEE4DEDC4D39"}]}]}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633","source":"talos-cna@cisco.com","tags":["Exploit","Third Party Advisory"]},{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2018-0633","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Third Party Advisory"]}]}}]}