Arm Scp Firmware vulnerabilities

3 CVEs affecting Arm Scp Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-11864, published 2025-01-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-11864, published 2025-01-14. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP
CVE-2024-11863, published 2025-01-14. Medium severity, CVSS 5.3. EPSS: 0.4% chance of exploitation in the next 30 days. Specifically crafted SCMI messages sent to an SCP running SCP-Firmware release versions up to and including 2.15.0 may lead to a Usage Fault and crash the SCP
CVE-2024-9413, published 2024-11-13. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. The transport_message_handler function in SCP-Firmware release versions 2.11.0-2.15.0 does not properly handle errors, potentially allowing an Application Processor (AP) to cause a buffer overflow in…