CVE-2025-45512

🔶 medium

Summary

A lack of signature verification in the bootloader of DENX Software Engineering Das U-Boot (U-Boot) v1.1.3 allows attackers to install crafted firmware files, leading to arbitrary code execution.

CVSS Score

6.5

Medium

EPSS Score

0.1

Exploit Probability

Published Date

2025-08-05

First Seen: 2026-01-05

📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 46.6% of all 365,890 vulnerabilities in our database.

#195,497

Below average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Aug 5, 2025

🔍 Exploitation Status

Poc

Proof-of-concept available

⚙️ Automatable

Requires human interaction

💥 Technical Impact

Total

Complete system compromise possible

SSVC data provided by CISA

Last Modified 2025-10-02

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CWE IDs (Weakness Types)

CWE-77

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
denx	u-boot	Affected	v1.1.3

🔗 References 2

https://gist.github.com/AzhariRamadhan/a5c9644861f46...

Exploit Third Party Advisory

https://github.com/AzhariRamadhan/uboot-cve

Exploit Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-29007	🔶 medium	5.3	0.6	U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFI...	2026-07-08
CVE-2026-29008	⚠️ high	7.5	0.6	U-Boot through 2026.04-rc3 contains an integer underflow vulnerability in the tcp_rx_state_machine() function (net/tcp.c...	2026-07-08
CVE-2026-29009	⚠️ high	8.2	0.6	U-Boot before 2026.07-rc2 contains a buffer overflow vulnerability in nfs_readlink_reply() (net/nfs-common.c) when CONFI...	2026-07-08
CVE-2026-46728	⚠️ high	8.2	0.2	Das U-Boot before 2026.04 allows FIT (Flat Image Tree) signature verification bypass because hashed-nodes is omitted fro...	2026-05-16
CVE-2026-33243	⚠️ high	8.2	0.1	barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 (and the corresponding backport t...	2026-03-20
CVE-2025-24857	⚠️ high	7.6	0.0	Improper access control for volatile memory containing boot code in Universal Boot Loader (U-Boot) before 2017.11 and Qu...	2025-12-10

These CVEs affect the same products