cve/2024/CVE-2024-38433.md

### [CVE-2024-38433](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38433)
![](https://img.shields.io/static/v1?label=Product&message=NPCM7xx%20(Poleg)%20BootBlock&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=All%20versions%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-305%3A%20Authentication%20Bypass%20by%20Primary%20Weakness&color=brightgreen)

### Description

Nuvoton - CWE-305: Authentication Bypass by Primary WeaknessAn attacker with write access to the SPI-Flash on an NPCM7xx BMC subsystem that uses the Nuvoton BootBlockreference code can modify the u-boot image header on flash parsed by the BootBlock which could lead to arbitrary codeexecution.

### POC

#### Reference
- https://www.gov.il/en/Departments/faq/cve_advisories

#### Github
No PoCs found on GitHub currently.