CVE-2021-37848: Pengutronix Barebox

High severity, CVSS 7.5. EPSS: 1.5% chance of exploitation in the next 30 days.

common/password.c in Pengutronix barebox through 2021.07.0 leaks timing information because strncmp is used during hash comparison.

Affected products

• Pengutronix Barebox: up to and including 2021.07.0

Published 2021-08-02. Last modified 2026-06-17.