PT-2025-35466

Name of the Vulnerable Software and Affected Versions: BootRom affected versions not specified Description: A missing payload size check in BootRom could lead to a memory buffer overflow, and does not require additional execution privileges. Recommendations: At the moment, there is no information...

PT-2025-35465

Name of the Vulnerable Software and Affected Versions: BootRom affected versions not specified Description: The BootRom software contains an unchecked command index issue. This could lead to local escalation of privilege without requiring additional execution privileges. Recommendations: At the...

PT-2025-35462

Name of the Vulnerable Software and Affected Versions: Cisco BootROM affected versions not specified Description: In BootROM, a missing validation check for Certificate Type 0 may allow for local privilege escalation without requiring additional execution privileges. Recommendations: At the momen...

CVE-2022-38694: Execution with Unnecessary Privileges

In BootRom, there is a possible unchecked write address. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38691: Execution with Unnecessary Privileges

In BootROM, there is a possible missing validation for Certificate Type 0. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38696: Improper Restriction of Operations within the Bounds of a Memory Buffer

In BootRom, there's a possible missing payload size check. This could lead to memory buffer overflow without requiring additional execution privileges...

PT-2025-35463

Name of the Vulnerable Software and Affected Versions: BootROM affected versions not specified Description: A missing size check for RSA keys during Certificate Type 0 validation in BootROM can lead to a memory buffer overflow. Exploitation of this issue does not require additional execution...

CVE-2022-38695: Execution with Unnecessary Privileges

In BootRom, there's a possible unchecked command index. This could lead to local escalation of privilege with no additional execution privileges needed...

CVE-2022-38692: Improper Restriction of Operations within the Bounds of a Memory Buffer

In BootROM, there is a missing size check for RSA keys in Certificate Type 0 validation. This could lead to memory buffer overflow without requiring additional execution privileges...

The vulnerability of the power supply and bootrom memory systems in the Renesas Electronics RH850/F1L microcontroller allows a perpetrator to gain access to protected information.

The vulnerability of the power supply and the bootrom memory system of the Renesas Electronics RH850/F1L microcontroller is related to improper protection against voltage spikes and clock frequency failures. Exploiting this vulnerability can allow an attacker to gain access to the protected...

CVE-2019-9536

Apple iPhone 3GS bootrom malloc implementation returns a non-NULL pointer when unable to allocate memory, aka 'alloc8'. An attacker with physical access to the device can install arbitrary firmware...

CVE-2018-6240

NVIDIA Tegra contains a vulnerability in BootRom where a user with kernel level privileges can write an arbitrary value to an arbitrary physical address...

Various Renesas products Security breaches

The Renesas SmartBond DA14691, among others, is a wireless connectivity multi-core microcontroller unit MCU from Renesas, Japan. A security vulnerability exists in several Renesas products, which originates from the bootrom function responsible for validating the Flash product header directly usi...

PT-2024-20727 · Renesas · Renesas Smartbond

Name of the Vulnerable Software and Affected Versions: Renesas SmartBond versions DA14691, DA14695, DA14697, and DA14699 Description: An issue was discovered where the bootrom function responsible for validating the Flash Product Header directly uses a user-controllable size value Length of Flash...

CVE-2024-25076: Buffer Copy without Checking Size of Input

An issue was discovered on Renesas SmartBond DA14691, DA14695, DA14697, and DA14699 devices. The bootrom function responsible for validating the Flash Product Header directly uses a user-controllable size value Length of Flash Config Section to control a read from the QSPI device into a fixed siz...

Hirschmann HiOS Switches Heap-based Buffer Overflow (CVE-2019-12257)

DHCP packets may go past the local area network LAN via DHCP-relays, but are otherwise confined to the LAN. The DHCP-client may be used by VxWorks and in the bootrom. Bootrom, using DHCP/BOOTP, is only vulnerable during the boot-process. This vulnerability may be used to overwrite the heap, which...

CVE-2021-34404

Android images for T210 provided by NVIDIA contain a vulnerability in BROM, where failure to limit access to AHB-DMA when BROM fails may allow an unprivileged attacker with physical access to cause denial of service or impact integrity and confidentiality beyond the security scope of BROM...

Exploit for Out-of-bounds Read in Nxp Lpc55S69Jbd100_Firmware

CVE-2021-40154...

CVE-2021-0467

In Chromecast bootROM, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the bootloader, with physical USB access, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

CVE-2021-0467

In Chromecast bootROM, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege in the bootloader, with physical USB access, with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...