Vulnerability-Lookup

CVE-2024-4760 (GCVE-0-2024-4760)

Vulnerability from cvelistv5 – Published: 2024-05-16 13:07 – Updated: 2025-06-06 15:08

Title

Voltage glitch during startup of the EEFC NVM controller can bypass the security bit

Summary

A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

Severity

6.3 (Medium)


                        
                          CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-24 19:22 UTC

CWE

CWE-1247 - Improper Protection Against Voltage and Clock Glitches

Assigner

Microchip CNA under the mitre root

CNA scorecard – unranked: 9 records in the last 180 days, 10 needed details

References

2 references

URL	Tags
https://www.0x01team.com/hw_security/bypassing-mi…	technical-descriptionexploit
https://ww1.microchip.com/downloads/aemDocuments/…	vendor-advisory

Impacted products

16 products

Vendor	Product	Version	CPE status
Microchip	SAME70	Affected: 0	guessed
Microchip	SAMS70	Affected: 0	guessed
Microchip	SAMV70	Affected: 0	guessed
Microchip	SAMV71	Affected: 0	guessed
Microchip	SAMG55	Affected: 0	guessed
Microchip	SAM4C	Affected: 0	guessed
Microchip	SAM4S	Affected: 0	guessed
Microchip	SAM4N	Affected: 0	guessed
Microchip	SAM4E	Affected: 0	guessed
Microchip	SAM3S	Affected: 0	guessed
Microchip	SAM3N	Affected: 0	guessed
Microchip	SAM3U	Affected: 0	guessed
amtel	same70	Affected: * cpe:2.3:a:amtel:same70::::::::
amtel	sams70	Affected: * cpe:2.3:a:amtel:sams70::::::::
amtel	samv70	Affected: * cpe:2.3:a:amtel:samv70::::::::
amtel	samv71	Affected: * cpe:2.3:a:amtel:samv71::::::::

Date Public

2024-05-16 13:00

Credits

Waleed Alzamil Bandar Alharbi Meshari Alhammadi

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:amtel:same70:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "same70",
            "vendor": "amtel",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:amtel:sams70:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "sams70",
            "vendor": "amtel",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:amtel:samv70:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "samv70",
            "vendor": "amtel",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          },
          {
            "cpes": [
              "cpe:2.3:a:amtel:samv71:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "samv71",
            "vendor": "amtel",
            "versions": [
              {
                "status": "affected",
                "version": "*"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-4760",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:22:40.820250Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T17:53:31.485Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T20:47:41.757Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "technical-description",
              "exploit",
              "x_transferred"
            ],
            "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "SAME70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMS70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMV70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMV71",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAMG55",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4C",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4S",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4N",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4E",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3S",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3N",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3U",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Physical control of the VDDCore pins\u003cbr\u003e"
            }
          ],
          "value": "Physical control of the VDDCore pins"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Waleed Alzamil"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Bandar Alharbi"
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Meshari Alhammadi"
        }
      ],
      "datePublic": "2024-05-16T13:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u0026nbsp;4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u0026nbsp;allows access to the memory bus via the debug interface even if the security bit is set."
            }
          ],
          "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u00a04C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u00a0allows access to the memory bus via the debug interface even if the security bit is set."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-624",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-624: Hardware Fault Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "PHYSICAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1247",
              "description": "CWE-1247: Improper Protection Against Voltage and Clock Glitches",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-06-06T15:08:03.023Z",
        "orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "shortName": "Microchip"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
        },
        {
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf"
        }
      ],
      "source": {
        "advisory": "PSIRT-73",
        "discovery": "EXTERNAL"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-15T17:19:00.000Z",
          "value": "Initial report"
        },
        {
          "lang": "en",
          "time": "2025-06-06T07:00:00.000Z",
          "value": "Vendor Advisory issued"
        }
      ],
      "title": "Voltage glitch during startup of the EEFC NVM controller can bypass the security bit",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Please contact Microchip to obtain the appropriate patch for your devices, which are available as binary code\u003cbr\u003eupdates."
            }
          ],
          "value": "Please contact Microchip to obtain the appropriate patch for your devices, which are available as binary code\nupdates."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
    "assignerShortName": "Microchip",
    "cveId": "CVE-2024-4760",
    "datePublished": "2024-05-16T13:07:57.462Z",
    "dateReserved": "2024-05-10T15:18:00.908Z",
    "dateUpdated": "2025-06-06T15:08:03.023Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-4760",
      "date": "2026-11-14",
      "epss": "0.00209",
      "percentile": "0.11206"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "affected",
                "product": "SAME70",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "SAMS70",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "SAMV70",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "SAMV71",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAMG55",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM4C",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM4S",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM4N",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM4E",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM3S",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM3N",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              },
              {
                "defaultStatus": "unaffected",
                "product": "SAM3U",
                "vendor": "Microchip",
                "versions": [
                  {
                    "status": "affected",
                    "version": "0"
                  }
                ]
              }
            ],
            "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"
          },
          {
            "affectedData": [
              {
                "cpes": [
                  "cpe:2.3:a:amtel:same70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "same70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:sams70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "sams70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:samv70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "samv70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:samv71:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "samv71",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u00a04C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u00a0allows access to the memory bus via the debug interface even if the security bit is set."
          },
          {
            "lang": "es",
            "value": "Una falla de voltaje durante el inicio de los controladores EEFC NVM en los microcontroladores Microchip SAM E70/S70/V70/V71 permite el acceso al bus de memoria a trav\u00e9s de la interfaz de depuraci\u00f3n incluso si el bit de seguridad est\u00e1 configurado."
          }
        ],
        "id": "CVE-2024-4760",
        "lastModified": "2026-06-17T08:02:50.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "PHYSICAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 0.4,
              "impactScore": 5.9,
              "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2024-4760",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-24T19:22:40.820250Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2024-05-16T13:15:47.893",
        "references": [
          {
            "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
            "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf"
          },
          {
            "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
            "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
          }
        ],
        "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-1247"
              }
            ],
            "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-06-06T16:12:32+00:00",
      "cve": "CVE-2024-4760",
      "id": "CVE-2024-4760",
      "initial_release_date": "2024-05-16T13:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Voltage glitch during startup of the EEFC NVM controller can bypass the security bit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-4760.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2024-08-01T20:47:41.757Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "tags": [
                  "technical-description",
                  "exploit",
                  "x_transferred"
                ],
                "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "affected": [
              {
                "cpes": [
                  "cpe:2.3:a:amtel:same70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "same70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:sams70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "sams70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:samv70:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "samv70",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              },
              {
                "cpes": [
                  "cpe:2.3:a:amtel:samv71:*:*:*:*:*:*:*:*"
                ],
                "defaultStatus": "unknown",
                "product": "samv71",
                "vendor": "amtel",
                "versions": [
                  {
                    "status": "affected",
                    "version": "*"
                  }
                ]
              }
            ],
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2024-4760",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2024-05-24T19:22:40.820250Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2024-05-24T19:28:10.134Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "affected",
              "product": "SAME70",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "SAMS70",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "SAMV70",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "affected",
              "product": "SAMV71",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAMG55",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM4C",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM4S",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM4N",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM4E",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM3S",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM3N",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            },
            {
              "defaultStatus": "unaffected",
              "product": "SAM3U",
              "vendor": "Microchip",
              "versions": [
                {
                  "status": "affected",
                  "version": "0"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Physical control of the VDDCore pins\u003cbr\u003e"
                }
              ],
              "value": "Physical control of the VDDCore pins"
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Waleed Alzamil"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Bandar Alharbi"
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Meshari Alhammadi"
            }
          ],
          "datePublic": "2024-05-16T13:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u0026nbsp;4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u0026nbsp;allows access to the memory bus via the debug interface even if the security bit is set."
                }
              ],
              "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u00a04C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u00a0allows access to the memory bus via the debug interface even if the security bit is set."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-624",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-624: Hardware Fault Injection"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "PHYSICAL",
                "availabilityImpact": "HIGH",
                "baseScore": 6.3,
                "baseSeverity": "MEDIUM",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-1247",
                  "description": "CWE-1247: Improper Protection Against Voltage and Clock Glitches",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-06-06T15:08:03.023Z",
            "orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
            "shortName": "Microchip"
          },
          "references": [
            {
              "tags": [
                "technical-description",
                "exploit"
              ],
              "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
            },
            {
              "tags": [
                "vendor-advisory"
              ],
              "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf"
            }
          ],
          "source": {
            "advisory": "PSIRT-73",
            "discovery": "EXTERNAL"
          },
          "timeline": [
            {
              "lang": "en",
              "time": "2024-02-15T17:19:00.000Z",
              "value": "Initial report"
            },
            {
              "lang": "en",
              "time": "2025-06-06T07:00:00.000Z",
              "value": "Vendor Advisory issued"
            }
          ],
          "title": "Voltage glitch during startup of the EEFC NVM controller can bypass the security bit",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "Please contact Microchip to obtain the appropriate patch for your devices, which are available as binary code\u003cbr\u003eupdates."
                }
              ],
              "value": "Please contact Microchip to obtain the appropriate patch for your devices, which are available as binary code\nupdates."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 0.1.0-dev"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "assignerShortName": "Microchip",
        "cveId": "CVE-2024-4760",
        "datePublished": "2024-05-16T13:07:57.462Z",
        "dateReserved": "2024-05-10T15:18:00.908Z",
        "dateUpdated": "2025-06-06T15:08:03.023Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

BDU:2026-00357 (CVE-2024-4760)

Vulnerability from fstec – Published: 2026-01-14 – Updated: 2026-01-14 – View on bdu.fstec.ru Exploit publicly available No remediation information

Title

Уязвимость микроконтроллеров Microchip SAM, связанная с неправильной защитой от сбоев напряжения и тактовой частоты, позволяющая нарушителю получить доступ к защищаемой информации

Summary

Уязвимость микроконтроллеров Microchip SAM связана с неправильной защитой от сбоев напряжения и тактовой частоты. Эксплуатация уязвимости может позволить нарушителю получить доступ к защищаемой информации

Severity

6.2 (Medium) CVSS 2.0


                      
                        AV:L/AC:H/Au:N/C:C/I:C/A:C

6.3 (Medium) CVSS 3.1


                      
                        CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Potential vulnerability

Exploitation

Probabilistic techniques

Incidents

Being clarified

Remediation

Being clarified

CWE

CWE-1247 - Неправильно реализованные схемы или датчики для обнаружения и устранения сбоев напряжения и синхронизации

Aliases

CVE-2024-4760

References

2 references

URL
https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocumen…
https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-…

Impacted products

12 products from 1 vendor

Vendors

Microchip Technology

Products

SAM E70, SAM S70, SAM V70, SAM V71, SAM G55, SAM 4C, SAM 4E, SAM 4N, SAM 4S, SAM 3N, SAM 3S, SAM 3U

Versions

- (SAM E70), - (SAM S70), - (SAM V70), - (SAM V71), - (SAM G55), - (SAM 4C), - (SAM 4E), - (SAM 4N), - (SAM 4S), - (SAM 3N), - (SAM 3S), - (SAM 3U)

Product types

ПО программно-аппаратного средства АСУ ТП

Mitigations

Компенсирующие меры: - ограничить физический доступ к критически важным устройствам, использующим микроконтроллеры серии SAM; - использовать индивидуальные критически важные данные для каждого устройства, например, криптографические ключи.

JSON

To clipboard

{
  "CVSS 2.0": "AV:L/AC:H/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "Microchip Technology",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "- (SAM E70), - (SAM S70), - (SAM V70), - (SAM V71), - (SAM G55), - (SAM 4C), - (SAM 4E), - (SAM 4N), - (SAM 4S), - (SAM 3N), - (SAM 3S), - (SAM 3U)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u041a\u043e\u043c\u043f\u0435\u043d\u0441\u0438\u0440\u0443\u044e\u0449\u0438\u0435 \u043c\u0435\u0440\u044b:\n- \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0444\u0438\u0437\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u043c, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u043c \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u044b \u0441\u0435\u0440\u0438\u0438 SAM;\n- \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0432\u0430\u0436\u043d\u044b\u0435 \u0434\u0430\u043d\u043d\u044b\u0435 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043a\u0440\u0438\u043f\u0442\u043e\u0433\u0440\u0430\u0444\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u043a\u043b\u044e\u0447\u0438.",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "16.05.2024",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "14.01.2026",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "14.01.2026",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2026-00357",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2024-4760",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0443\u0435\u0442",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "SAM E70, SAM S70, SAM V70, SAM V71, SAM G55, SAM 4C, SAM 4E, SAM 4N, SAM 4S, SAM 3N, SAM 3S, SAM 3U",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 Microchip SAM, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u0430\u044f \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0441\u0431\u043e\u0435\u0432 \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0438 \u0442\u0430\u043a\u0442\u043e\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u043e\u0442\u044b, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0421\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u0432 \u043e\u0442\u043a\u0440\u044b\u0442\u043e\u043c \u0434\u043e\u0441\u0442\u0443\u043f\u0435",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e \u0440\u0435\u0430\u043b\u0438\u0437\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u0441\u0445\u0435\u043c\u044b \u0438\u043b\u0438 \u0434\u0430\u0442\u0447\u0438\u043a\u0438 \u0434\u043b\u044f \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u044f \u0438 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0441\u0431\u043e\u0435\u0432 \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0438 \u0441\u0438\u043d\u0445\u0440\u043e\u043d\u0438\u0437\u0430\u0446\u0438\u0438 (CWE-1247)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u0438\u043a\u0440\u043e\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u043b\u0435\u0440\u043e\u0432 Microchip SAM \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u043e\u0439 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 \u0441\u0431\u043e\u0435\u0432 \u043d\u0430\u043f\u0440\u044f\u0436\u0435\u043d\u0438\u044f \u0438 \u0442\u0430\u043a\u0442\u043e\u0432\u043e\u0439 \u0447\u0430\u0441\u0442\u043e\u0442\u044b. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0437\u0430\u0449\u0438\u0449\u0430\u0435\u043c\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u0412\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u043d\u044b\u0435 \u043c\u0435\u0442\u043e\u0434\u044b",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf\nhttps://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u041e \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e-\u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0410\u0421\u0423 \u0422\u041f",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-1247",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,2)\n\u0421\u0440\u0435\u0434\u043d\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 6,3)"
}

FKIE_CVE-2024-4760

Vulnerability from fkie_nvd - Published: 2024-05-16 13:15 - Updated: 2026-06-17 08:02

Severity

6.3 (Medium) - CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	dc3f6da9-85b5-4a73-84a2-2ec90b40fca5	https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf
	dc3f6da9-85b5-4a73-84a2-2ec90b40fca5	https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/
	af854a3a-2127-422b-91ae-364da2661108	https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "affected",
          "product": "SAME70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMS70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMV70",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "SAMV71",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAMG55",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4C",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4S",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4N",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM4E",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3S",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3N",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "SAM3U",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:amtel:same70:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "same70",
          "vendor": "amtel",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:amtel:sams70:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "sams70",
          "vendor": "amtel",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:amtel:samv70:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "samv70",
          "vendor": "amtel",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        },
        {
          "cpes": [
            "cpe:2.3:a:amtel:samv71:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unknown",
          "product": "samv71",
          "vendor": "amtel",
          "versions": [
            {
              "status": "affected",
              "version": "*"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM\u00a04C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers\u00a0allows access to the memory bus via the debug interface even if the security bit is set."
    },
    {
      "lang": "es",
      "value": "Una falla de voltaje durante el inicio de los controladores EEFC NVM en los microcontroladores Microchip SAM E70/S70/V70/V71 permite el acceso al bus de memoria a trav\u00e9s de la interfaz de depuraci\u00f3n incluso si el bit de seguridad est\u00e1 configurado."
    }
  ],
  "id": "CVE-2024-4760",
  "lastModified": "2026-06-17T08:02:50.677",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "PHYSICAL",
          "availabilityImpact": "HIGH",
          "baseScore": 6.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.4,
        "impactScore": 5.9,
        "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-4760",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-05-24T19:22:40.820250Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-05-16T13:15:47.893",
  "references": [
    {
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
      "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf"
    },
    {
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
      "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security/"
    }
  ],
  "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-1247"
        }
      ],
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
      "type": "Secondary"
    }
  ]
}

GHSA-5MP7-G9P8-P9XX

Vulnerability from github – Published: 2024-05-16 15:31 – Updated: 2025-06-06 15:30

Details

A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71 microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

Severity

6.3 (Medium)


                  
                    CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-4760"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1247"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-05-16T13:15:47Z",
    "severity": "MODERATE"
  },
  "details": "A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71 microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.",
  "id": "GHSA-5mp7-g9p8-p9xx",
  "modified": "2025-06-06T15:30:34Z",
  "published": "2024-05-16T15:31:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4760"
    },
    {
      "type": "WEB",
      "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/MCU32/ProductDocuments/SupportingCollateral/Security-Advisory-CVE-2024-4760.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.0x01team.com/hw_security/bypassing-microchip-atmel-sam-e70-s70-v70-v71-security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-4760 (GCVE-0-2024-4760)

BDU:2026-00357 (CVE-2024-4760)

FKIE_CVE-2024-4760

GHSA-5MP7-G9P8-P9XX

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour