{"cve":"CVE-2021-31532","nvd":{"published":"2021-05-06T13:15:12.667","modified":"2026-06-17T03:51:57.913","status":"Modified","description":"NXP LPC55S6x microcontrollers (0A and 1B), i.MX RT500 (silicon rev B1 and B2), i.MX RT600 (silicon rev A0, B0), LPC55S6x, LPC55S2x, LPC552x (silicon rev 0A, 1B), LPC55S1x, LPC551x (silicon rev 0A) and LPC55S0x, LPC550x (silicon rev 0A) include an undocumented ROM patch peripheral that allows unsigned, non-persistent modification of the internal ROM.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":6.8},"cwes":[],"references":["https://oxide.computer/blog/lpc55/","https://www.nxp.com","https://oxide.computer/blog/lpc55/","https://www.nxp.com"],"products":["nxp:i.mx_rt500_firmware","nxp:i.mx_rt600_firmware","nxp:lpc5512jbd100_firmware","nxp:lpc5512jbd64_firmware","nxp:lpc5514jbd100_firmware","nxp:lpc5514jbd64_firmware","nxp:lpc5516jbd100_firmware","nxp:lpc5516jbd64_firmware","nxp:lpc5516jev98_firmware","nxp:lpc5526_firmware","nxp:lpc5528_firmware","nxp:lpc55s14jbd100_firmware","nxp:lpc55s14jbd64_firmware","nxp:lpc55s16jbd100_firmware","nxp:lpc55s16jbd64_firmware","nxp:lpc55s16jev98_firmware","nxp:lpc55s26_firmware","nxp:lpc55s28_firmware","nxp:lpc55s66jbd100_firmware","nxp:lpc55s69jbd100_firmware","nxp:lpc55s69jbd64_firmware","nxp:lpc55s69jev98_firmware","nxp:lpcs66jbd64_firmware","nxp:lpcs66jev98_firmware"],"source":"nvd","synced_at":"2026-10-19T21:18:09.669877188+00:00"},"epss":{"cve":"CVE-2021-31532","score":0.00452,"percentile":0.39262,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}