{"id":"CVE-2018-18558","details":"An issue was discovered in Espressif ESP-IDF 2.x and 3.x before 3.0.6 and 3.1.x before 3.1.1. Insufficient validation of input data in the 2nd stage bootloader allows a physically proximate attacker to bypass secure boot checks and execute arbitrary code, by crafting an application binary that overwrites a bootloader code segment in process_segment in components/bootloader_support/src/esp_image_format.c. The attack is effective when the flash encryption feature is not enabled, or if the attacker finds a different vulnerability that allows them to write this binary to flash memory.","modified":"2026-07-08T17:56:20.284897Z","published":"2019-05-13T13:29:02.103Z","references":[{"type":"WEB","url":"https://www.espressif.com/en/news/Espressif_Product_Security_Advisory_Concerning_Secure_Boot_%28CVE-2018-18558%29"},{"type":"ADVISORY","url":"https://github.com/espressif/esp-idf/releases"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/espressif/esp-idf","events":[{"introduced":"024ef51d1ae541172f5736b25df8692932382539"},{"fixed":"bb56d86fde5052bbc06d3c574ea4b83e9405bfe9"},{"introduced":"22489d70214a5b7650ab197ffd6ab73e9c50a772"},{"last_affected":"3b92e85b308578c24f14f57371498303c198c7cb"}],"database_specific":{"cpe":"cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.0"},{"fixed":"3.0.6"},{"introduced":"3.1"},{"last_affected":"3.1.1"}],"source":"CPE_RANGE"}}],"versions":["v3.1.1","v3.0.6-rc","v3.1.1-rc2","v3.0.5-rc","v3.0.5","v3.0.4-rc1","v3.0.4","v3.1-rc2","v3.1","v3.1-rc1","v3.0.3-rc","v3.0.3","v3.0.2","v3.1-beta1","v3.0.1-rc","v3.0.1","v3.0","v3.0-rc1","v3.1-dev"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-18558.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}