Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.5

Zynq UltraScale+ firmware allows boot settings to be changed

CVE-2019-5478 · published 7 years ago
Summary

The boot process in certain Zynq UltraScale+ firmware versions can be tampered with, letting an attacker alter the control information that decides how the system starts. This could cause the device to skip security checks or run unauthorized code. Apply the latest firmware updates from AMD and use the full secure‑boot mode instead of the encrypt‑only option.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
amd zu3eg_firmware All versions
cpe:2.3:o:amd:zu3eg_firmware:-:*:*:*:*:*:*:*
amd zu11eg_firmware All versions
cpe:2.3:o:amd:zu11eg_firmware:-:*:*:*:*:*:*:*
amd zu15eg_firmware All versions
cpe:2.3:o:amd:zu15eg_firmware:-:*:*:*:*:*:*:*
amd zu17eg_firmware All versions
cpe:2.3:o:amd:zu17eg_firmware:-:*:*:*:*:*:*:*
amd zu19eg_firmware All versions
cpe:2.3:o:amd:zu19eg_firmware:-:*:*:*:*:*:*:*
amd zu1cg_firmware All versions
cpe:2.3:o:amd:zu1cg_firmware:-:*:*:*:*:*:*:*
amd zu1eg_firmware All versions
cpe:2.3:o:amd:zu1eg_firmware:-:*:*:*:*:*:*:*
amd zu21dr_firmware All versions
cpe:2.3:o:amd:zu21dr_firmware:-:*:*:*:*:*:*:*
amd zu25dr_firmware All versions
cpe:2.3:o:amd:zu25dr_firmware:-:*:*:*:*:*:*:*
amd zu27dr_firmware All versions
cpe:2.3:o:amd:zu27dr_firmware:-:*:*:*:*:*:*:*
amd zu28dr_firmware All versions
cpe:2.3:o:amd:zu28dr_firmware:-:*:*:*:*:*:*:*
amd zu29dr_firmware All versions
cpe:2.3:o:amd:zu29dr_firmware:-:*:*:*:*:*:*:*
amd zu2cg_firmware All versions
cpe:2.3:o:amd:zu2cg_firmware:-:*:*:*:*:*:*:*
amd zu2eg_firmware All versions
cpe:2.3:o:amd:zu2eg_firmware:-:*:*:*:*:*:*:*
amd zu39dr_firmware All versions
cpe:2.3:o:amd:zu39dr_firmware:-:*:*:*:*:*:*:*
amd zu3cg_firmware All versions
cpe:2.3:o:amd:zu3cg_firmware:-:*:*:*:*:*:*:*
amd zu3tcg_firmware All versions
cpe:2.3:o:amd:zu3tcg_firmware:-:*:*:*:*:*:*:*
amd zu3teg_firmware All versions
cpe:2.3:o:amd:zu3teg_firmware:-:*:*:*:*:*:*:*
amd zu42dr_firmware All versions
cpe:2.3:o:amd:zu42dr_firmware:-:*:*:*:*:*:*:*
amd zu43dr_firmware All versions
cpe:2.3:o:amd:zu43dr_firmware:-:*:*:*:*:*:*:*
amd zu46dr_firmware All versions
cpe:2.3:o:amd:zu46dr_firmware:-:*:*:*:*:*:*:*
amd zu47dr_firmware All versions
cpe:2.3:o:amd:zu47dr_firmware:-:*:*:*:*:*:*:*
amd zu48dr_firmware All versions
cpe:2.3:o:amd:zu48dr_firmware:-:*:*:*:*:*:*:*
amd zu49dr_firmware All versions
cpe:2.3:o:amd:zu49dr_firmware:-:*:*:*:*:*:*:*
amd zu4cg_firmware All versions
cpe:2.3:o:amd:zu4cg_firmware:-:*:*:*:*:*:*:*
amd zu4eg_firmware All versions
cpe:2.3:o:amd:zu4eg_firmware:-:*:*:*:*:*:*:*
amd zu4ev_firmware All versions
cpe:2.3:o:amd:zu4ev_firmware:-:*:*:*:*:*:*:*
amd zu5cg_firmware All versions
cpe:2.3:o:amd:zu5cg_firmware:-:*:*:*:*:*:*:*
amd zu5eg_firmware All versions
cpe:2.3:o:amd:zu5eg_firmware:-:*:*:*:*:*:*:*
amd zu5ev_firmware All versions
cpe:2.3:o:amd:zu5ev_firmware:-:*:*:*:*:*:*:*
amd zu63dr_firmware All versions
cpe:2.3:o:amd:zu63dr_firmware:-:*:*:*:*:*:*:*
amd zu64dr_firmware All versions
cpe:2.3:o:amd:zu64dr_firmware:-:*:*:*:*:*:*:*
amd zu65dr_firmware All versions
cpe:2.3:o:amd:zu65dr_firmware:-:*:*:*:*:*:*:*
amd zu67dr_firmware All versions
cpe:2.3:o:amd:zu67dr_firmware:-:*:*:*:*:*:*:*
amd zu6cg_firmware All versions
cpe:2.3:o:amd:zu6cg_firmware:-:*:*:*:*:*:*:*
amd zu6eg_firmware All versions
cpe:2.3:o:amd:zu6eg_firmware:-:*:*:*:*:*:*:*
amd zu7cg_firmware All versions
cpe:2.3:o:amd:zu7cg_firmware:-:*:*:*:*:*:*:*
amd zu7eg_firmware All versions
cpe:2.3:o:amd:zu7eg_firmware:-:*:*:*:*:*:*:*
amd zu7ev_firmware All versions
cpe:2.3:o:amd:zu7ev_firmware:-:*:*:*:*:*:*:*
amd zu9cg_firmware All versions
cpe:2.3:o:amd:zu9cg_firmware:-:*:*:*:*:*:*:*
amd zu9eg_firmware All versions
cpe:2.3:o:amd:zu9eg_firmware:-:*:*:*:*:*:*:*
Original advisory text
A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure ...
A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-657Violation of Secure Design Principles
CWE-345Insufficient Verification of Data Authenticity
Timeline
Published3 Sep 2019
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-5478 · NVD
Track software like this
Free during beta