Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

Espressif ESP-IDF can be tricked to run malicious code

CVE-2018-18558 · published 7 years ago
Summary

The ESP-IDF development framework for Espressif chips can be fooled by a nearby attacker into skipping its secure‑boot checks and running code of the attacker’s choosing. This happens if the device’s flash encryption is not turned on or another flaw lets the attacker write a crafted program to the chip’s memory. Apply the latest ESP-IDF updates (3.0.6 for 3.0 series and 3.1.1 for 3.1 series) and ensure flash encryption is enabled to protect against this risk.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
espressif esp-idf >= 2.0, < 3.0.6
>= 3.1, <= 3.1.1
cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacke...
An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published13 May 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-18558 · NVD
Track software like this
Free during beta