« Volver al listado

CVE-2025-9614

Estado: AnalizadaMedia (6.5)—

An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushing during device rebinding may allow stale write transactions from a previous security context to be processed in a new one. This can lead to unintended data access across trusted domains, compromising confidentiality and integrity.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Pcisig — PCI Express Integrity AND Data Encryption

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-9614",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-9614",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-12-10T20:09:17.808849Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "PCI-SIG",
          "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "6.5-Rev7.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "vendor": "PCI-SIG",
          "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "7.1-Rev7.0",
              "versionType": "custom"
            }
          ]
        }
      ]
    }
  ],
  "published": "2025-12-09T19:15:50.943",
  "references": [
    {
      "url": "https://pcisig.com/PCIeIDEStandardVulnerabilities",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "https://pcisig.com/specifications",
      "tags": [
        "Product"
      ],
      "source": "cret@cert.org"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on re-keying and stream flushing during device rebinding may allow stale write transactions from a previous security context to be processed in a new one. This can lead to unintended data access across trusted domains, compromising confidentiality and integrity."
    }
  ],
  "lastModified": "2026-06-17T10:09:23.050",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:pcisig:pci_express_integrity_and_data_encryption:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5FC26D98-4F15-4B0D-B661-BF2894CF8F5B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}