CVE-2019-14237
9.8
CRITICAL · CVSS 3.1 · EPSS 2.9% (pctl 87)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can be defeated by observing CPU registers and the effect of code/instruction execution.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 2.92% — more likely to be exploited than 87% of all CVEs |
| Weakness | CWE-863 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2019-09-12 |
| Last modified | 2026-06-17 |
Affected (6)
| Vendor | Product |
|---|---|
| nxp | kinetis k8x |
| nxp | kinetis k8x firmware |
| nxp | kinetis kv1x |
| nxp | kinetis kv1x firmware |
| nxp | kinetis kv3x |
| nxp | kinetis kv3x firmware |
References
→ the Explorer · watch your stack · NVD