Cyber Resilience

CVE-2024-4760

Published
16 May 2024
Modified
15 April 2026
CVSS Score v3.1 6.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0021 11th percentile
Risk Priority 45 floored blend · peak EPSS

Summary

CVE-2024-4760 is a medium-severity Improper Protection Against Voltage and Clock Glitches (CWE-1247) vulnerability in 0X01Team (inferred from references). Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-18 (Tamper Resistance and Detection) and SR-9 (Tamper Resistance and Detection) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A voltage glitch during the startup of EEFC NVM controllers on Microchip SAM E70/S70/V70/V71, SAM G55, SAM 4C/4S/4N/4E, and SAM 3S/3N/3U microcontrollers allows access to the memory bus via the debug interface even if the security bit is set.

CWE(s)
CWE-1247

Related Threats

MITRE ATT&CK Enterprise Techniques

T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
attack.mitre.org →
T1553.002 Code Signing Defense Impairment
Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.
attack.mitre.org →
T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
attack.mitre.org →
T1600.001 Reduce Key Space Defense Impairment
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.
attack.mitre.org →
T1542 Pre-OS Boot Stealth
Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.
attack.mitre.org →
T1542.003 Bootkit Stealth
Adversaries may use bootkits to persist on systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-54520Shared CWE-1247

Affected Assets

0X01Team
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-18 Tamper Resistance and Detection good match

Tamper-resistance requirements directly drive the addition of glitch-detection circuitry and sensors that the CWE describes as missing or incorrect.

SR-9 Tamper Resistance and Detection good match

A tamper-protection program mandates hardware mechanisms that detect and respond to voltage/clock faults before they can be exploited.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.IR-02 mostly match
prevents

Directly addresses hardware protection from environmental or physical tampering threats such as voltage/clock glitches.

ID.RA-09 partial match
prevents

Requires assessing hardware security capabilities before acquisition, indirectly catching missing glitch protections.

PR.AA-06 partial match
prevents

Limits physical access that many glitch attacks require, but does not address on-chip detection circuitry.

PR.PS-03 partial match
prevents

Ensures hardware lacking glitch-detection circuitry is replaced when risk warrants.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.7.5 Protecting against physical and environmental threats partial match
degrades

Physical and environmental threat controls can include hardware-level protections against voltage/clock tampering.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture and engineering principles can mandate glitch-detection circuitry and fault-injection countermeasures.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing in development can discover and validate protections against voltage and clock glitch attacks.

References