CVE-2025-25733

Incorrect access control in the SPI Flash Chip of Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units RSUs v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 allows physically proximate attackers to arbitrarily modify SPI flash regions, leading to a degradation of the security posture of the devi...

Kapsch TrafficCom RIS-9160和Kapsch TrafficCom RIS-9260 RSU LEO 安全漏洞

The Kapsch TrafficCom RIS-9260 RSU LEO and the Kapsch TrafficCom RIS-9160 are both a road measurement unit from Kapsch TrafficCom, Austria, with functions of communication and co-management of connected vehicles in intelligent transportation. A security vulnerability exists in the Kapsch TrafficC...

CVE-2025-25735

Kapsch TrafficCom RIS-9160 & RIS-9260 Roadside Units RSUs v3.2.0.829.23, v3.8.0.1119.42, and v4.6.0.1211.28 were discovered to lack SPI Protected Range Registers PRRs, allowing attackers with software running on the system to modify SPI flash in real-time...

CVE-2023-28468

An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. The FvbServicesRuntimeDxe SMM module exposes an SMI handler that allows an attacker to interact with the SPI flash at run-time from the OS...

CVE-2022-42285

DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization PEIphase, where a privileged user can disable SPI flash protection, which may lead to denial of service, escalation of privileges, or data tampering...

CVE-2025-37896 spi: spi-mem: Add fix to avoid divide error

In the Linux kernel, the following vulnerability has been resolved: spi: spi-mem: Add fix to avoid divide error For some SPI flash memory operations, dummy bytes are not mandatory. For example, in Winbond SPINAND flash memory devices, the writecache and updatecache operation variants have zero...

CVE-2024-33660

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected...

CVE-2024-33660

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected...

CVE-2024-2315

APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability...

CVE-2024-2315 SMM arbitrary code execution in Overclock

APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability...

CVE-2024-2315 SMM arbitrary code execution in Overclock

APTIOV contains a vulnerability in BIOS where may cause Improper Access Control by a local attacker. Successful exploitation of this vulnerability may lead to unexpected SPI flash modifications and BIOS boot kit launches, also impacting the availability...

CVE-2024-2315

CVE-2024-2315 concerns AMI AptioV BIOS firmware with an issue labeled as an improper access control vulnerability in the BIOS that could allow a local attacker to modify SPI flash and trigger BIOS boot kit launches, potentially affecting availability and, to a lesser extent, integrity according t...

CVE-2024-33660 Potential Firmware update without integrity check

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected...

CVE-2024-33660 Potential Firmware update without integrity check

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected...

CVE-2024-33660

CVE-2024-33660 describes a vulnerability in AMI AptioV firmware whereby an attacker with physical access can manipulate SPI flash without detection, potentially enabling firmware tampering. Connected sources (CNNVD, CIRCL, CVELIST, VULNRICHMENT) corroborate AMI AptioV/SPI‑flash context; however, ...

CVE-2024-44815

Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV...

Skyworth Router CM5100 安全漏洞

The Skyworth Router CM5100 is a single-band router with N300 speed from Skyworth China. A security vulnerability exists in the Hathway Skyworth Router CM5100 version 4.1.1.24, which originates from a vulnerability that allows a physically proximate attacker to obtain user credentials via SPI flas...

CVE-2024-44815

Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV...

CVE-2024-44815

Vulnerability in Hathway Skyworth Router CM5100 v.4.1.1.24 allows a physically proximate attacker to obtain user credentials via SPI flash Firmware W25Q64JV...

CVE-2024-44815

CVE-2024-44815 affects Hathway Skyworth Router CM5100 v4.1.1.24. The issue allows a physically proximate attacker to obtain user credentials through the SPI flash memory (W25Q64JV). According to the sources, the vulnerability exposes credentials via firmware storage exposed on the SPI flash, with...