CVE-2021-32015

MEDIUM
Published Jun 8, 20215y ago · Modified Jun 17, 20262w ago
6.0 CVSS 3.1
Medium
Find Similar
Published Jun 8, 2021 5y ago
Last Modified Jun 17, 2026 2w ago

Description

In Nuvoton NPCT75x TPM 1.2 firmware 7.4.0.0, a local authenticated malicious user with high privileges could potentially gain unauthorized access to TPM non-volatile memory. NOTE: Upgrading to firmware version 7.4.0.1 will mitigate against the vulnerability, but version 7.4.0.1 is not TCG or Common Criteria (CC) certified. Nuvoton recommends that users apply the NPCT75x TPM 1.2 firmware update.

CVSS Details

Base Score
6.0
Exploitability
0.8
Impact
5.2
Vector string
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack Vector Local
Attack Complexity Low
Privileges Required High
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None

Threat Intelligence

No active exploitation signals — not in CISA KEV and no EPSS score yet.

Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 2

VendorProductVersionRange
nuvotonnpct75x_firmware7.4.0.0any
nuvotonnpct75x1.2any

References 1

  • nuvoton.com https://www.nuvoton.com/support/product-related-information/security-advisories/sa-001/
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.