CVE-2024-28183

MEDIUM
Published Mar 25, 2024 Modified Dec 5, 2025 CWE-367

Description

ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). The vulnerability is fixed in 4.4.7 and 5.2.1.

Is your site exposed to CVE-2024-28183?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.1
MEDIUM
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-367 CWE-367

Affected Products

Vendor Product
espressif esp-idf
espressif esp-idf
espressif esp-idf
espressif esp-idf

References

Advisories & Patches

https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2 https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3 https://github.com/espressif/esp-idf/commit/534e3ad1fa68526a5f989fb2163856d6b7cd2c87 https://github.com/espressif/esp-idf/commit/7003f1ef0dffc73c34eb153d1b0710babb078149 https://github.com/espressif/esp-idf/commit/b2cdc0678965790f49afeb6e6b0737cd24433a05 https://github.com/espressif/esp-idf/commit/c33b9e1426121ce8cccf1a94241740be9cff68de https://github.com/espressif/esp-idf/commit/f327ddf6adab0c28d395975785727b2feef57803 https://github.com/espressif/esp-idf/security/advisories/GHSA-22x6-3756-pfp8 https://github.com/espressif/esp-idf/commit/3305cb4d235182067936f8e940e6db174e25b4b2 https://github.com/espressif/esp-idf/commit/4c95aa445d4e84f01f86b6f3a552aa299276abf3 https://github.com/espressif/esp-idf/commit/534e3ad1fa68526a5f989fb2163856d6b7cd2c87 https://github.com/espressif/esp-idf/commit/7003f1ef0dffc73c34eb153d1b0710babb078149 https://github.com/espressif/esp-idf/commit/b2cdc0678965790f49afeb6e6b0737cd24433a05 https://github.com/espressif/esp-idf/commit/c33b9e1426121ce8cccf1a94241740be9cff68de https://github.com/espressif/esp-idf/commit/f327ddf6adab0c28d395975785727b2feef57803 https://github.com/espressif/esp-idf/security/advisories/GHSA-22x6-3756-pfp8

Frequently Asked Questions

What is CVE-2024-28183? +
ESP-IDF is the development framework for Espressif SoCs supported on Windows, Linux and macOS. A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. Anti-rollback prevents rollback to application with security version lower than one programmed in eFuse of chip. This attack can allow to boot past (passive) application partition having lower security version of the same device even in the presence of the flash encryption scheme. The attack requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader (before loading the application). The vulnerability is fixed in 4.4.7 and 5.2.1. It has a CVSS v3.1 base score of 6.1 (MEDIUM).
How severe is CVE-2024-28183? +
CVE-2024-28183 has a CVSS v3.1 score of 6.1 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.
What products are affected by CVE-2024-28183? +
CVE-2024-28183 affects products from espressif, specifically: esp-idf. Check the affected products table above for specific version ranges.
How do I check if I'm vulnerable to CVE-2024-28183? +
You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-5958

When sed is invoked with both -i (in-place edit) and --follow-symlinks, the function open_next_file() performs two separate, non-atomic filesystem operations …
CVE-2026-42336

MaxKB is an open-source AI assistant for enterprise. MaxKB 2.8.0 and prior are vulnerable to a server-side request forgery (SSRF) …
CVE-2025-26620

Duende.AccessTokenManagement is a set of .NET libraries that manage OAuth and OpenId Connect access tokens. Duende.AccessTokenManagement contains a race condition …
CVE-2024-53694

A time-of-check time-of-use (TOCTOU) race condition vulnerability has been reported to affect several product versions. If exploited, the vulnerability could …
CVE-2025-32784

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race …
CVE-2025-34027

The Versa Concerto SD-WAN orchestration platform is vulnerable to an authentication bypass in the Traefik reverse proxy configuration, allowing at …

Don't wait for an exploit

Scan your website for vulnerabilities like CVE-2024-28183 — free, no signup required.