What’s Vulnerable › Vulnerabilities

CVE-2019-5478

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-09-03 · updated 2026-06-17
• Weakness: CWE-657

Description

A weakness was found in Encrypt Only boot mode in Zynq UltraScale+ devices. This could lead to an adversary being able to modify the control fields of the boot image leading to an incorrect secure boot behavior.

Affected products

• AMD Zu11Eg Firmware: all versions
• AMD Zu15Eg Firmware: all versions
• AMD Zu17Eg Firmware: all versions
• AMD Zu19Eg Firmware: all versions
• AMD Zu1Cg Firmware: all versions
• AMD Zu1Eg Firmware: all versions
• AMD Zu21Dr Firmware: all versions
• AMD Zu25Dr Firmware: all versions
• AMD Zu27Dr Firmware: all versions
• AMD Zu28Dr Firmware: all versions
• AMD Zu29Dr Firmware: all versions
• AMD Zu2Cg Firmware: all versions
• AMD Zu2Eg Firmware: all versions
• AMD Zu39Dr Firmware: all versions
• AMD Zu3Cg Firmware: all versions
• AMD Zu3Eg Firmware: all versions
• AMD Zu3Tcg Firmware: all versions
• AMD Zu3Teg Firmware: all versions
• AMD Zu42Dr Firmware: all versions
• AMD Zu43Dr Firmware: all versions
• AMD Zu46Dr Firmware: all versions
• AMD Zu47Dr Firmware: all versions
• AMD Zu48Dr Firmware: all versions
• AMD Zu49Dr Firmware: all versions
• AMD Zu4Cg Firmware: all versions
• AMD Zu4Eg Firmware: all versions
• AMD Zu4Ev Firmware: all versions
• AMD Zu5Cg Firmware: all versions
• AMD Zu5Eg Firmware: all versions
• AMD Zu5Ev Firmware: all versions

References

• https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt
• https://www.xilinx.com/support/answers/72588.html
• https://github.com/inversepath/advisories/blob/master/Security_Advisory-Ref_FSC-HWSEC-VR2019-0001-Xilinx_ZU+-Encrypt_Only_Secure_Boot_bypass.txt
• https://www.xilinx.com/support/answers/72588.html

Get alerted when CVE-2019-5478 or the next vulnerability affects your stack