Executive brief
esptool is a utility for flashing firmware to Espressif microcontrollers. The tool uses a weak encryption mode (AES ECB) during device initialization, which allows attackers to observe patterns in encrypted data and potentially recover sensitive configuration information without requiring authentication or special access.
Technical details
esptool uses AES ECB (Electronic Codebook) mode for encrypting initialization data sent to Espressif microcontrollers. AES ECB is cryptographically weak because it encrypts identical plaintext blocks to identical ciphertext blocks, leaking information about plaintext patterns. This vulnerability exists in the espsecure module (lines 128 and 1195 of __init__.py) and affects all versions through 4.6.2. An attacker with network or physical access to the initialization traffic can perform ciphertext analysis to recover sensitive configuration data. No user interaction or authentication is required to exploit this weakness during the initialization phase.
Affected products
- Espressif esptool through 4.6.2
Timeline
- 2023-10-23: disclosed: Vulnerability reported on GitHub issue #926
- 2023-11-09: advisory: GHSA-3f38-96qm-r3fw and CVE-2023-46894 published