{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-18349",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-24T20:17:41.440102Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-24T20:18:42.750Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "SAMA5D4",
          "vendor": "Microchip",
          "versions": [
            {
              "status": "affected",
              "version": "0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Access to the VCC_CORE pin."
            }
          ],
          "value": "Access to the VCC_CORE pin."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Vladimir Kononovich"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\u003cp\u003eThis issue affects SAMA5D4.\u003c/p\u003e"
            }
          ],
          "value": "Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\n\nThis issue affects SAMA5D4."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-624",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-624 Hardware Fault Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "PHYSICAL",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "HIGH",
            "subIntegrityImpact": "HIGH",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1247",
              "description": "CWE-1247 Improper protection against voltage and clock glitches",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-27T16:40:02.564Z",
        "orgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "shortName": "Microchip"
      },
      "references": [
        {
          "url": "https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/sama5d44-fault-injection-vulnerability"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Because this attack requires direct physical access to the device\u2019s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.\u0026nbsp; This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment."
            }
          ],
          "value": "Because this attack requires direct physical access to the device\u2019s core power supply, the most effective protection is to prevent such access. Customers deploying the SAMA5D4 in security-sensitive applications should review the physical-security assumptions of their deployment and consider measures that make the core supply rail physically inaccessible.\u00a0 This includes avoiding exposed test points or headers on that rail and employing mechanical protections such as potting, conformal coating, shielding, or tamper-resistant enclosures to prevent attachment of fault-injection equipment."
        }
      ],
      "source": {
        "advisory": "PSIRT-151",
        "discovery": "UNKNOWN"
      },
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-06T07:00:00.000Z",
          "value": "Reported"
        }
      ],
      "title": "SAMA5D44 Fault Injection Vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.4"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
    "assignerShortName": "Microchip",
    "cveId": "CVE-2026-18349",
    "datePublished": "2026-08-24T16:07:45.500Z",
    "dateReserved": "2026-07-30T05:06:19.951Z",
    "dateUpdated": "2026-10-27T16:40:02.564Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-18349\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-24T20:17:41.440102Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-24T20:18:38.380Z\"}}], \"cna\": {\"title\": \"SAMA5D44 Fault Injection Vulnerability\", \"source\": {\"advisory\": \"PSIRT-151\", \"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Vladimir Kononovich\"}], \"impacts\": [{\"capecId\": \"CAPEC-624\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-624 Hardware Fault Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 7.3, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"PHYSICAL\", \"baseSeverity\": \"HIGH\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:P/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H\", \"exploitMaturity\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"HIGH\", \"vulnAvailabilityImpact\": \"HIGH\", \"subConfidentialityImpact\": \"HIGH\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Microchip\", \"product\": \"SAMA5D4\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\"}], \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-07-06T07:00:00.000Z\", \"value\": \"Reported\"}], \"references\": [{\"url\": \"https://www.microchip.com/en-us/solutions/technologies/embedded-security/how-to-report-potential-product-security-vulnerabilities/sama5d44-fault-injection-vulnerability\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.4\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\\n\\nThis issue affects SAMA5D4.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.\u003cp\u003eThis issue affects SAMA5D4.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-1247\", \"description\": \"CWE-1247 Improper protection against voltage and clock glitches\"}]}], \"configurations\": [{\"lang\": \"en\", \"value\": \"Access to the VCC_CORE pin.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Access to the VCC_CORE pin.\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"shortName\": \"Microchip\", \"dateUpdated\": \"2026-08-24T16:07:45.500Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-18349\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-24T20:18:42.750Z\", \"dateReserved\": \"2026-07-30T05:06:19.951Z\", \"assignerOrgId\": \"dc3f6da9-85b5-4a73-84a2-2ec90b40fca5\", \"datePublished\": \"2026-08-24T16:07:45.500Z\", \"assignerShortName\": \"Microchip\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}