GCVE-110-CERTCC-2017-166743

Advisory PublishedCVSS 5.6/10

Vulnetix · Advisory published September 8, 2017

Das U-Boot is a device bootloader that can read its configuration from an AES encrypted file. For devices utilizing this environment encryption mode, U-Boot's use of a zero initialization vector and improper handling of an error condition may allow attacks against the underlying cryptographic implementation and allow an attacker to decrypt the data.

Download JSON Open in Console

Risk Scores

CVSS 2.0

5.6/10

Medium · AV:L/AC:H/Au:N/C:C/I:C/A:N

certcc-cam

impact0population0exploitation0widely_known0score_current0ease_of_exploitation0

certcc-vrda

d1_impact2d1_population2d1_direct_report1

certcc-cvss-temporal-env

temporal_score5remediation_levelUreport_confidenceCenvironmental_score3.81229308432target_distributionMenvironmental_vectorCDP:ND/TD:M/CR:ND/IR:ND/AR:ND

Aliases

CVE-2017-3225 CVE-2017-3226

References

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

url

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

url

Das U-Boot AES-CBC encryption implementation contains multiple vulnerabilities

advisory

Browse GCVE Records

73,118 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON