Medium severity6.7NVD Advisory· Published Jul 11, 2024· Updated Jun 17, 2026

CVE-2024-38433

Description

Nuvoton - CWE-305: Authentication Bypass by Primary Weakness

An attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlock

reference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary code

execution.

Nuvoton/Npcm705r Firmware
cpe:2.3:o:nuvoton:npcm705r_firmware:*:*:*:*:*:*:*:*
Range: <10.10.19
Nuvoton/Npcm710r Firmware
cpe:2.3:o:nuvoton:npcm710r_firmware:*:*:*:*:*:*:*:*
Range: <10.10.19
Nuvoton/Npcm730r Firmware
cpe:2.3:o:nuvoton:npcm730r_firmware:*:*:*:*:*:*:*:*
Range: <10.10.19
Nuvoton/Npcm750r Firmware
cpe:2.3:o:nuvoton:npcm750r_firmware:*:*:*:*:*:*:*:*
Range: <10.10.19
Nuvoton/NPCM7xx BMC subsystemllm-create
Nuvoton/Npcm7xx (poleg) Bootblockv5
Range: All versions

No linked articles in our index yet.