VulnerabilityPublished 15 Oct 2024Updated 30 Oct 2024

CVE-2024-31955: Improper Certificate Validation

Source CVE Database V5

Not known to be exploited · CVSS 4.9 Medium.

Data as of 26 Oct 2026, 12:54 UTC

CVSS 3.1 base score

4.9Medium

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 14% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AC:H/AV:P/A:N/C:N/I:H/PR:N/S:C/UI:N

Attack Complexity: High
Attack Vector: Physical
Availability: None
Confidentiality: None
Integrity: High
Privileges Required: None
Scope: Changed
User Interaction: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Complexity: High: A successful attack depends on conditions beyond the attacker's control. That is, a successful attack cannot be accomplished at will, but requires the attacker to invest in some measurable amount of effort in preparation or execution against the vulnerable component before a successful attack can be expected. For example, a successful attack may require an attacker to: gather knowledge about the environment in which the vulnerable target/component exists; prepare the target environment to improve exploit reliability; or inject themselves into the logical network path between the target and the resource requested by the victim in order to read and/or modify network communications (e.g., a man in the middle attack).
Attack Vector: Physical: The attack requires the attacker to physically touch or manipulate the vulnerable component. Physical interaction may be brief or persistent.
Availability: None: There is no impact to availability within the impacted component.
Confidentiality: None: There is no loss of confidentiality within the impacted component.
Integrity: High: There is a total loss of integrity, or a complete loss of protection. For example, the attacker is able to modify any/all files protected by the impacted component. Alternatively, only some files can be modified, but malicious modification would present a direct, serious consequence to the impacted component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 15 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Given the hardware-level nature of this vulnerability and the lack of available patches, mitigation strategies should focus on reducing attack feasibility and exposure. Organizations should: 1) Enforce strict physical security controls to prevent unauthorized physical access to devices containing affected Samsung eMMC components. 2) Monitor vendor advisories closely for firmware updates or hardware revisions addressing this issue and apply them promptly once available. 3) Employ tamper-evident seals or intrusion detection mechanisms on devices to detect physical tampering attempts. 4) Consider using alternative storage components or devices with hardware security modules not susceptible to EMFI attacks for high-security applications. 5) Implement layered security controls, including secure boot and runtime integrity checks, to detect unauthorized modifications potentially enabled by RPMB compromise. 6) Educate security teams about the risks of fault injection attacks and incorporate hardware security assessments into regular security audits. 7) For critical deployments, consider hardware shielding or EMFI-resistant design features if feasible. These measures collectively reduce the risk and impact of exploitation until a direct patch or hardware fix is available.

Description

An issue was discovered in Samsung eMMC with KLMAG2GE4A and KLM8G1WEMB firmware. Code bypass through Electromagnetic Fault Injection allows an attacker to successfully authenticate and write to the RPMB (Replay Protected Memory Block) area without possessing secret information.

Impact

The primary impact of CVE-2024-31955 is the compromise of the integrity of the RPMB area within affected Samsung eMMC devices. Unauthorized write access to RPMB can allow attackers to manipulate secure storage contents, potentially altering firmware, security keys, or sensitive data. This can lead to persistent device compromise, bypass of secure boot processes, or undermining trusted execution environments. Although confidentiality and availability are not directly impacted, the integrity breach can facilitate further attacks or persistent malware implants. The requirement for physical access and specialized EMFI equipment limits the scope of exploitation to targeted attacks rather than widespread remote exploitation. However, devices in sensitive environments or with high-value data could be at significant risk. Organizations deploying affected eMMC devices in mobile phones, IoT devices, or embedded systems may face increased risk of hardware-level compromise, especially in scenarios where physical device access cannot be tightly controlled.

CWE-295Improper Certificate Validation (opens in a new tab)
Base weaknessOWASP Top 10 A07:2025: Authentication Failures (opens in a new tab)
The product does not validate, or incorrectly validates, a certificate.
Architecture and Design · Implementation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
OWASP Cheat Sheets
Transport Layer Protection (opens in a new tab)
TLS Cipher String (opens in a new tab)
OWASP Authentication (opens in a new tab)
OWASP ASVS 4.0.3
V9.2.1 (opens in a new tab)
V1.9.2 (opens in a new tab)
V2.8.5 (opens in a new tab)
Attack patterns
Creating a Rogue Certification Authority Certificate (opens in a new tab)
Signature Spoofing by Improper Validation (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

semiconductor.samsung.com/support/quality-support/product-security-updates/ (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 26 Feb 2026, 16:16 UTC

WeaknessesCWE-295

Technical details

References

Community reviews

Related threats