What’s Vulnerable › Vulnerabilities

CVE-2024-38532: TEST_KEY used in example dcp_tool reference implementation

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-28 · updated 2026-06-17
• Weakness: CWE-321

Description

The NXP Data Co-Processor (DCP) is a built-in hardware module for specific NXP SoCs¹ that implements a dedicated AES cryptographic engine for encryption/decryption operations. The dcp_tool reference implementation included in the repository selected the test key, regardless of its `-t` argument. This issue has been patched in commit 26a7.

Affected products

• usbarmory mxs-dcp: from commit 6151, < commit 26a7

References

• https://github.com/usbarmory/mxs-dcp/commit/e5a99cb3d9429e6145495da7d01525c75af426a7
• https://github.com/usbarmory/mxs-dcp/security/advisories/GHSA-g85c-rh49-p8cq
• https://github.com/usbarmory/mxs-dcp/commit/e5a99cb3d9429e6145495da7d01525c75af426a7
• https://github.com/usbarmory/mxs-dcp/security/advisories/GHSA-g85c-rh49-p8cq

Get alerted when CVE-2024-38532 or the next vulnerability affects your stack