St STM32CUBE Middleware vulnerabilities

6 CVEs affecting St STM32CUBE Middleware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-34268, published 2021-07-22.

More from St.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-34262, published 2021-07-22. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the USBH_ParseEPDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
• CVE-2021-34260, published 2021-07-22. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the USBH_ParseInterfaceDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
• CVE-2021-34259, published 2021-07-22. Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days. A buffer overflow vulnerability in the USBH_ParseCfgDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below allows attackers to execute arbitrary code.
• CVE-2021-34268, published 2021-07-22. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. An issue in the USBH_ParseDevDesc() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) via a malformed USB device packet.
• CVE-2021-34267, published 2021-07-22. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. An in the USBH_MSC_InterfaceInit() function of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service (DOS) when the system tries to communicate with the connected…
• CVE-2021-34261, published 2021-07-22. Medium severity, CVSS 4.6. EPSS: 0.4% chance of exploitation in the next 30 days. An issue in USBH_ParseCfgDesc() of STMicroelectronics STM32Cube Middleware v1.8.0 and below causes a denial of service due to the system hanging when trying to set a remote wake-up feature.