What is CVE-2021-32015?

CVE-2021-32015 is a medium-severity vulnerability in Nuvoton Npct75x, classified under Missing Authorization. CVSS score: 6.0/10. Published 2021-06-08.

How severe is CVE-2021-32015?

Medium severity. CVSS v3 base score is 6.0 out of 10.

Auth bypass in Nuvoton Npct75x

CVE-2021-32015

In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update.

Vulnerability class: Broken Access Control

EPSS: 0.002 (12.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.0 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N.

Affected products

Nuvoton Npct75x — versions 1.2
Nuvoton Npct75x_firmware — versions 7.4.0.0
N/a — versions n/a

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

cve@mitre.org (x_refsource_MISC, Vendor Advisory)

Frequently asked questions

What is CVE-2021-32015?: CVE-2021-32015 is a medium-severity vulnerability in Nuvoton Npct75x, classified under Missing Authorization. CVSS score: 6.0/10. Published 2021-06-08.
How severe is CVE-2021-32015?: Medium severity. CVSS v3 base score is 6.0 out of 10.