CVE-2020-11683 json
A timing side channel was discovered in AT91bootstrap before 3.9.2.
published 2020-09-14 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-4025
- cvss
- 6.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 44%
- public exploits
- 0
- none known
Summary
A timing side channel was discovered in AT91bootstrap before 3.9.2. It can be exploited by attackers with physical access to forge CMAC values and subsequently boot arbitrary code on an affected system.
Patch / fix
Exploit prediction
0.51% chance of exploitation in the next 30 days, higher than 44% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- labs.f-secure.com https://labs.f-secure.com/advisories/microchip-at91bootstrap/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 6.8 | CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Classification
- Weakness
-
- CWE-203 Observable Discrepancy
References
-
github.com
/linux4sam/at91bootstrap/commit/7753914c9a622c245f3a3cf2af5e24b6a9904213
patch, third-party-advisory
-
labs.f-secure.com
/advisories/microchip-at91bootstrap/
exploit, third-party-advisory
Sources
- CVE List CVE-2020-11683
- NVD CVE-2020-11683
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.