An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through…
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An issue was discovered in Espressif ESP-IDF 2.x, 3.0.x through 3.0.9, 3.1.x through 3.1.6, 3.2.x through 3.2.3, and 3.3.x through 3.3.1. An attacker who uses fault injection to physically disrupt the ESP32 CPU can bypass the Secure Boot digest verification at startup, and boot unverified code from flash. The fault injection attack does not disable the Flash Encryption feature, so if the ESP32 is configured with the recommended combination of Secure Boot and Flash Encryption, then the impact is minimized. If the ESP32 is configured without Flash Encryption then successful fault injection allows arbitrary code execution. To protect devices with Flash Encryption and Secure Boot enabled against this attack, a firmware change must be made to permanently enable Flash Encryption in the field if it is not already permanently enabled.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* | 3.0 to before 3.0.9; after 3.1, before 3.1.6; after 3.2, before 3.2.3; 3.3 to before 3.3.1 | Vulnerable | espressif |
- cpe:2.3:a:espressif:esp-idf:*:*:*:*:*:*:*:* Versions 3.0 to before 3.0.9; after 3.1, before 3.1.6; after 3.2, before 3.2.3; 3.3 to before 3.3.1 Vulnerable ·espressif
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2019-15894
- 2026-10-03 Alias added: GHSA-hgpr-gf26-38f8
References
More espressif Esp-idf vulnerabilities
- TI-2024-22076 Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to execute… CVSS 3.1MEDIUM 6.5
- TI-2026-33125 ESF-IDF: Out-of-Bounds Write in ESP-TEE Secure Service Wrappers CVSS 3.1CRITICAL 9.3
- TI-2025-32598 ESP-NOW Integer Underflow Vulnerability Advisory CVSS 4.0HIGH 7.2
- TI-2022-08703 Espressif Bluetooth Mesh Stack Vulnerable to Out-of-bounds Write leading to memory buffer corruption CVSS 3.1HIGH 8.8
- TI-2021-09371 The Bluetooth Classic implementation in Espressif ESP-IDF 4.4 and earlier does not… CVSS 3.1HIGH 8.8
- TI-2026-33292 ESF-IDF: Remote Null Pointer Dereference in WebSocket Server CVSS 3.1HIGH 7.5
Sources
- CVE-2019-15894 · CVE Program
- CVE-2019-15894 · NVD
- FIRST EPSS
- GHSA-hgpr-gf26-38f8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences