CVE-2020-13465

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

The security protection in Gigadevice GD32F103 devices allows physical attackers to redirect the control flow and execute arbitrary code via the debug interface.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://www.usenix.org/system/files/woot20-paper-obermaier.pdfExploit, Technical Description, Third Party Advisory
https://www.usenix.org/system/files/woot20-paper-obermaier.pdfExploit, Technical Description, Third Party Advisory

Timeline

Published: Aug 31, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-134666.8STMicroelectronics STM32F103 devices through 2020-05-20 allow physical attackers to execute arbitrary code via a power glitch and a specific CVE-2020-134674.6The flash memory readout protection in China Key Systems & Integrated Circuit CKS32F103 devices allows physical attackers to extract firmwar CVE-2020-134686.8Gigadevice GD32F130 devices allow physical attackers to escalate their debug interface permissions via fault injection into inter-IC bonding CVE-2020-134694.6The flash memory readout protection in Gigadevice GD32VF103 devices allows physical attackers to extract firmware via the debug interface by CVE-2020-13477.8An elevation of privilege vulnerability exists when the Windows Storage Services improperly handle file operations, aka 'Windows Storage Ser CVE-2020-134704.6Gigadevice GD32F103 and GD32F130 devices allow physical attackers to extract data via the probing of easily accessible bonding wires and de-CVE-2020-134716.8Apex Microelectronics APM32F103 devices allow physical attackers to execute arbitrary code via a power glitch and a specific flash patch/bre CVE-2020-134724.6The flash memory readout protection in Gigadevice GD32F103 devices allows physical attackers to extract firmware via the debug interface by CVE-2020-134735.5NCH Express Accounts 8.24 and earlier allows local users to discover the cleartext password by reading the configuration file.CVE-2020-134746.5In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functional CVE-2020-134764.8NCH Express Invoice 8.06 to 8.24 is vulnerable to Reflected XSS in the Quotes List module.CVE-2020-13486.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows