CVE-2017-18347

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-09-12 · updated 2026-06-17
Weakness: CWE-362

Description

Incorrect access control in RDP Level 1 on STMicroelectronics STM32F0 series devices allows physically present attackers to extract the device's protected firmware via a special sequence of Serial Wire Debug (SWD) commands because there is a race condition between full initialization of the SWD interface and the setup of flash protection.

Affected products

Stm32F030C6 Firmware: all versions
Stm32F030C8 Firmware: all versions
Stm32F030Cc Firmware: all versions
Stm32F030F4 Firmware: all versions
Stm32F030K6 Firmware: all versions
Stm32F030R8 Firmware: all versions
Stm32F030Rc Firmware: all versions
Stm32F031C4 Firmware: all versions
Stm32F031C6 Firmware: all versions
Stm32F031E6 Firmware: all versions
Stm32F031F4 Firmware: all versions
Stm32F031F6 Firmware: all versions
Stm32F031G4 Firmware: all versions
Stm32F031G6 Firmware: all versions
Stm32F031K4 Firmware: all versions
Stm32F038C6 Firmware: all versions
Stm32F038E6 Firmware: all versions
Stm32F038F6 Firmware: all versions
Stm32F038G6 Firmware: all versions
Stm32F038K6 Firmware: all versions
Stm32F042C4 Firmware: all versions
Stm32F042C6 Firmware: all versions
Stm32F042F4 Firmware: all versions
Stm32F042F6 Firmware: all versions
Stm32F042G4 Firmware: all versions
Stm32F042G6 Firmware: all versions
Stm32F042K4 Firmware: all versions
Stm32F042K6 Firmware: all versions
Stm32F042T6 Firmware: all versions
Stm32F048C6 Firmware: all versions

References

Get alerted when CVE-2017-18347 or the next vulnerability affects your stack