« Volver al listado

CVE-2025-48515

Estado: AplazadaMedia (5.4)—

Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

AMD — Secure ProcessorAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-48515",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-48515",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T20:44:21.883358Z"
        }
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "psirt@amd.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.4,
          "Automatable": "NOT_DEFINED",
          "attackVector": "PHYSICAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "HIGH",
          "attackRequirements": "NONE",
          "privilegesRequired": "HIGH",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@amd.com",
      "affectedData": [
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 4000 Series Mobile Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "RenoirPI-FP6 1.0.0.Ed"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 7030 Series Mobile Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "CezannePI-FP6_1.0.1.1c"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 5000 Series Mobile Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "CezannePI-FP6_1.0.1.1c"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 4000 Series Desktop Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "RenoirPI-FP6_1.0.0.Ec"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ 5000 Series Desktop Processors with Radeon™ Graphics",
          "versions": [
            {
              "status": "unaffected",
              "version": "ComboAM4v2PI_1.2.0.11"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "vendor": "AMD",
          "product": "AMD Ryzen™ Embedded V2000 Series Processors",
          "versions": [
            {
              "status": "unaffected",
              "version": "EmbeddedPI-FP6_1.0.0.D"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-02-10T20:16:45.250",
  "references": [
    {
      "url": "https://www.amd.com/en/resources/product-security/bulletin/AMD-SB-4013.html",
      "source": "psirt@amd.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "psirt@amd.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insufficient parameter sanitization in AMD Secure Processor (ASP) Boot Loader could allow an attacker with access to SPIROM upgrade to overwrite the memory, potentially resulting in arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Sanitización insuficiente de parámetros en el Boot Loader del Procesador Seguro de AMD (ASP) podría permitir a un atacante con acceso a la actualización de SPIROM sobrescribir la memoria, lo que podría resultar en ejecución de código arbitrario."
    }
  ],
  "lastModified": "2026-06-17T09:29:45.217",
  "sourceIdentifier": "psirt@amd.com"
}