CVE-2021-44479

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-12-01 · updated 2026-06-17
Weakness: CWE-125

Description

NXP Kinetis K82 devices have a buffer over-read via a crafted wlength value in a GET Status-Other request during use of USB In-System Programming (ISP) mode. This discloses protected flash memory.

Affected products

NXP Kinetis K82 Firmware: all versions

References

https://github.com/Xen1thLabs-AE/CVE-2021-40154
https://www.darkmatter.ae/xen1thlabs/published-advisories/
https://github.com/Xen1thLabs-AE/CVE-2021-40154
https://www.darkmatter.ae/xen1thlabs/published-advisories/

Get alerted when CVE-2021-44479 or the next vulnerability affects your stack