CVE-2022-38161

low-risk

Published 2022-08-11

The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory containing the bitstream for the FPGA.

Do I need to act?

0.17% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 7.5/10 High

ADJACENT_NETWORK / HIGH complexity

Affected Products (1)

Overo Sbc

Affected Vendors

Gumstix

References (6)

Third Party Advisory https://github.com/subreption/birdwatch-report-1-repo

Technical Description https://subreption.com/downloads/reports/demystifying-the-orlan-10_opt.pdf

Third Party Advisory https://subreption.com/press-releases/2022-birdwatch-first-report/

Third Party Advisory https://github.com/subreption/birdwatch-report-1-repo

Technical Description https://subreption.com/downloads/reports/demystifying-the-orlan-10_opt.pdf

Third Party Advisory https://subreption.com/press-releases/2022-birdwatch-first-report/

/ 100

low-risk

Severity 20/34 · Moderate

Exploitability 1/34 · Minimal

Exposure 5/34 · Minimal