CVE-2025-36755
Raw vector
CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:X/V:D/RE:L/U:GreenSummary
CVE-2025-36755 is a low-severity On-Chip Debug and Test Interface With Improper Access Control (CWE-1191) vulnerability in Divd (inferred from references). Its CVSS base score is 2.4 (Low).
Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-203085
Vulnerability Data
The CleverDisplay BlueOne hardware player is designed with its USB interfaces physically enclosed and inaccessible under normal operating conditions. Researchers demonstrated that, after cicumventing the device’s protective enclosure, it was possible to connect a USB keyboard and press ESC during…
more
boot to access the BIOS setup interface. BIOS settings could be viewed but not modified. This behavior slightly increases the attack surface by exposing internal system information (CWE-1244) once the enclosure is removed, but does not allow integrity or availability compromise under standard or tested configurations.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
AC-3 directly requires enforcement of authorization checks on all logical access paths, which would block unauthorized use of the debug/test interface registers.
AC-6 requires restricting access rights to the minimum needed, limiting what an attacker reaching the debug interface can actually read or modify.
Mandates restrictive, approved configuration settings that would block unsafe debug access level assignments.
IA-3 requires device identification and authentication before any connection is established, which would apply to external debug or test equipment.
Requires application of security engineering principles such as least privilege and isolation during design of debug mechanisms.
Isolates security functions from non-security functions, reducing exposure of internal assets through debug paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices throughout the life cycle are the primary means of avoiding unsafe debug access assignments.
Defining and enforcing access permissions directly addresses improper authorization to debug interfaces.
Managing physical access to assets covers control of on-chip debug/test ports and pins.
Configuration management practices ensure debug interfaces receive the intended access-level settings.
Authentication of hardware can help restrict debug interface use but is narrower than full access control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover improper debug access but does not itself implement the control.
Physical perimeters can limit access to debug ports but do not address on-chip access-control logic.
Physical entry controls reduce the chance of an attacker reaching the chip but do not enforce on-chip debug authorization.
Privileged utility programs may include debug tools, but the control does not address hardware debug access levels.
Privileged-access rules may extend to hardware debug interfaces, yet the control is not hardware-specific.
Secure SDLC encourages hardware security requirements but does not mandate debug-port controls.