CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NCVE-2019-5478
Medium (5.5) in amd. EPSS 0.2% chance of exploitation in the next 30 days.
A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 16% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-345, CWE-657
- Published
- Modified
- Record from
- the NVD, synced
Affected
- amd:zu11eg_firmware
- amd:zu15eg_firmware
- amd:zu17eg_firmware
- amd:zu19eg_firmware
- amd:zu1cg_firmware
- amd:zu1eg_firmware
- amd:zu21dr_firmware
- amd:zu25dr_firmware
- amd:zu27dr_firmware
- amd:zu28dr_firmware
- amd:zu29dr_firmware
- amd:zu2cg_firmware
- amd:zu2eg_firmware
- amd:zu39dr_firmware
- amd:zu3cg_firmware
- amd:zu3eg_firmware
- amd:zu3tcg_firmware
- amd:zu3teg_firmware
- amd:zu42dr_firmware
- amd:zu43dr_firmware
- amd:zu46dr_firmware
- amd:zu47dr_firmware
- amd:zu48dr_firmware
- amd:zu49dr_firmware
- amd:zu4cg_firmware
- amd:zu4eg_firmware
- amd:zu4ev_firmware
- amd:zu5cg_firmware
- amd:zu5eg_firmware
- amd:zu5ev_firmware
- amd:zu63dr_firmware
- amd:zu64dr_firmware
- amd:zu65dr_firmware
- amd:zu67dr_firmware
- amd:zu6cg_firmware
- amd:zu6eg_firmware
- amd:zu7cg_firmware
- amd:zu7eg_firmware
- amd:zu7ev_firmware
- amd:zu9cg_firmware
- amd:zu9eg_firmware
References
- https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt
- https://www.xilinx.com/support/answers/72588.html
- https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt
- https://www.xilinx.com/support/answers/72588.html