• Advisories

Found 35 results
Select All Title 正文 Version Advisory No. Type Released Date Fixed Status Download
Security Advisory Concerning Timing Attacks on ECDSA Peripheral in ESP32-H2

This advisory describes a security vulnerability in the ESP32-H2 chip's (chip revision < v1.2) ECDSA peripheral, where timing differences in signature generation can lead to potential attacks, providing solutions such as enabling Secure Boot, updating ESP-IDF, and upgrading the chip revision to v1.2 for enhanced security.

V1.0 AR2024-007 Security 2024.11.26 Notification
Bug Advisory Concerning Software Reset Failure on ESP32-S3 After OTA Upgrade to Specific ESP-IDF Versions with Quad SPI Flash Access Frequency Increased to 120 MHz

This advisory describes the issue of software reset failure on ESP32-S3 after OTA upgrade to specific ESP-IDF versions with Quad SPI Flash Access Frequency increased to 120 MHz, along with corresponding solutions.

V1.0 AR2024-010 Bugs 2024.10.12 Fixed
Security Advisory for PEAP Phase 2 Authentication
This advisory describes vulnerabilities in PEAP phase-2 authentication and its solution.
 
V1.1 AR2024-003 Security 2024.09.19 Fixed
Bug Advisory Concerning Applications Using Auto Light Sleep on ESP32-C6 with Certain ESP-IDF Versions

This advisory describes issues with certain ESP32-C6 products in applications where the Wi-Fi and Bluetooth LE modules coexist or when only the Wi-Fi module is initialized and auto light-sleep is enabled, along with the corresponding solutions.

V1.0 AR2024-006 Bugs 2024.08.30 Fixed with Commit
Bug Advisory Concerning Data Corruption in RTC Memory of ESP32-C3 / ESP32-S3

The advisory describes two issues where improper power configuration leads to abnormal RTC memory data storage, along with the corresponding solutions.

V1.0 AR2024-005 Bugs 2024.08.15 Fixed
Compatibility Advisory for ESP32-C3 Chip Revision v1.1

This advisory describes the required software configurations to use ESP32-C3 chip revision v1.1 and its compatibility with chip revision v0.4.

V1.0 AR2024-009 Compatibility 2024.07.22 Announcement
Bug Advisory Concerning Low Wi-Fi Transmit Power on ESP32-C3 (chip revision v0.1 ~ v1.0)

This advisory describes and provides a solution for an issue that using specific PHY versions and configurations in ESP32-C3 chips (chip versions v0.1~v1.0) can result in a 20 dB decrease in Wi-Fi transmit power in certain ESP-IDF versions.

V1.0 AR2024-002 Bugs 2024.07.09 Fixed
End-of-Life Advisory for ESP-IDF v4.4 Release Branch

ESP-IDF v4.4 Release Branch reaches End-of-Life in July of 2024.

V1.0 AR2024-008 End-of-Life 2024.07.02 Announcement
Bug Advisory Concerning Upgrading ESP-IDF for Applications Using Deep-Sleep Functionality based on Certain ESP-IDF Versions

This advisory describes two issues that lead to abnormal functionality due to incorrect module initialization timing after deepsleep wake-up and provides solutions for users.

V1.0 AR2024-004 Bugs 2024.06.11 Fixed
Bug Advisory Concerning Some Android Phones Being Unable to Scan the Advertising PDUs Sent by ESP32 Bluetooth LE

This advisory describes and provides solution about an issue in ESP32 concerning certain Android phones being unable to scan the advertising PDUs sent by Bluetooth LE when in the Wi-Fi and Bluetooth coexistence mode.

V1.1 AR2024-001 Bugs 2024.05.30 Fixed
Bug Advisory for ESP32-C3’s Bluetooth LE Disconnection from iPhone in Bluetooth LE and Wi-Fi Coexistence Scenarios

This advisory describes the bug and solution for the Bluetooth LE ACL disconnection between certain new iPhone models and the ESP32-C3 series of products running specific ESP-IDF versions. Such disconnection will happen shortly after the connection is established when Wi-Fi and Bluetooth LE are used at the same time.

V1.1 AR2023-002 Bugs 2024.05.30 Fixed
Security Advisory for WLAN FragAttacks

This security advisory describes vulnerabilities affecting WLAN FragAttacks and their solutions.

V1.1 AR2023-008 Security 2024.05.20 Fixed
Advisory for the Probabilistic Failure of Wi-Fi and Bluetooth on Some Chips

This advisory focuses on a bug in ESP32, ESP32-C3, ESP32-S3, and ESP32-S2 chips.  BLE and WiFi call the corresponding deinit function before initialization, Bluetooth and WiFi will probabilistically fail to work properly. The advisory also provides practi

V1.0 AR2023-009 Bugs 2024.02.07 Fixed
Security Advisory for Classic Bluetooth BLUFFS Vulnerability

The advisory briefly describes BLUFFS vulnerability and the implementation level mitigations on ESP32 series products for now.

V1.0 AR2023-010 Security 2024.01.19 Notification
End-of-Life Advisory for ESP-IDF v4.3 Release Branch

ESP-IDF v4.3 Release Branch reaches End-of-Life in end of 2023.

V1.0 AR2023-011 End-of-Life 2024.01.08 Announcement
Security Advisory Concerning Bypassing Secure Boot and Flash Encryption using CPA and FI attack on ESP32-C3 and ESP32-C6

The advisory focuses on a crucial hardware vulnerability discovered in ESP32-C3 and ESP32-C6 chips. The vulnerability stems from a combination of Correlation Power Analysis (CPA), Fault Injection (FI), and buffer overflow, allowing attackers to bypass the Flash Encryption feature that uses the AES-XTS algorithm, extracting sensitive device information. Additionally, the advisory offers suggestions for hardware and application countermeasures that can effectively mitigate this type of attack.

V1.0 AR2023-007 Security 2024.01.08 Notification
Security Advisory concerning Wi-Fi authentication bypass
V1.1 AR2020-002 Security 2023.11.03 Fixed
Advisory for Upgrading ESP-IDF for Application That Has Enabled [Auto Suspend] or [XIP from PSRAM]

This advisory describes the bug and solution for possible data corruption in the main flash due to concurrent access in some conditions. The cause is: concurrent access to main flash (connected to SPI0 CS0) with esp_flash API is bypassed in some conditions. Unexpected concurrent access may cause data corruption in the main flash, which may forbid the device from booting up. The solution is: applications that has enabled [Auto Suspend] or [XIP from PSRAM] shall upgrade ESP-IDF to the fixed version.

V1.0 AR2023-003 Bugs 2023.09.04 Fixed
Security Advisory for WFA vulnerability

This security advisory describes vulnerabilities affecting Wi-Fi devices and their solutions.

V1.1 AR2021-003 Security 2023.08.25 Fixed
Security Advisory Concerning Bypassing Secure Boot and Flash Encryption Using EMFI

This security advisory describes an issue summary and impact analysis of a technique called Electromagnetic Fault Injection (EMFI), which allows bypassing Secure Boot V2 and Flash Encryption on the ESP32 with directly jumping to the UART Download mode implemented in the ROM code. The advisory also provides practical tips for customers on using the ESP32 chip.

V1.0 AR2023-005 Security 2023.07.11 Notification
End-of-Life Advisory for ESP-IDF v4.2 Release Branch

ESP-IDF v4.2 Release Branch reaches End-of-Life in June 2023.

V1.0 AR2023-004 End-of-Life 2023.06.30 Announcement
End-of-Life Advisory for ESP-IDF v4.1 Release Branch

ESP-IDF v4.1 release branch reaches End-of-Life in February, 2023.a

V1.0 AR2023-001 End-of-Life 2023.03.01 Announcement
Security Advisory for USB_OTG & USB_Serial_JTAG Download Functions of ESP32-S3 Series Products
For ESP32-S3 series chips manufactured on and after Date Code 2219 and modules and development boards with the PW No. of and after PW-2022-06-XXXX, the bit (BLK0 B19[7]) will be open for users to program since it will not be programmed by default. This will enable the USB_OTG Download function.
V1.1 AR2022-004 Security 2022.12.21 Fixed
Security Advisory Concerning Breaking the Hardware AES Core and Firmware Encryption of ESP32 Chip Revision v3.0
This security advisory provides an issue summary and impact analysis of the side-channel attack (SCA) and body bias injection (BBI), which allow attackers to exploit the power consumption trajectory characteristics of ESP32/ESP32-S2/ESP32-S3/ESP32-C3 series chips when performing encryption and decryption to obtain sensitive information in the chip. The advisory also provides practical tips for customers on using the ESP32/ESP32-S2/ESP32-S3/ESP32-C3/ESP32-C2 series chips.

V2.0 AR2022-003 Security 2022.11.18 Notification
Compatibility Advisory for Chip Revision Numbering Scheme

Espressif introduced vM.X numbering scheme to indicate chip revisions.

V1.0 AR2022-005 Compatibility 2022.09.29 Announcement
Optimization of eFuse Programming for ESP32 / ESP32-C3 / ESP32-S2 / ESP32-S3 Series of Chips
This advisory describes a rare issue related to Secure Boot v1, Secure Boot v2, and/or flash encryption, and its solution. Note that, this issue can only happen when using specific versions of ESP-IDF for ESP32, ESP32-C3, and ESP32-S2 series products.

V1.0 AR2022-006 Application 2022.09.26 Fixed
End-of-Life Advisory for ESP-IDF v3.3 Release Branch

ESP-IDF v3.3 release branch reaches End-of-Life in February, 2022.

V1.0 AR2022-002 End-of-Life 2022.02.22 Announcement
End-of-Life Advisory for ESP-IDF v4.0 Release Branch

ESP-IDF v4.0 release branch reaches End-of-Life in October, 2021.

V1.0 AR2021-007 End-of-Life 2022.01.06 Announcement
Unable to Boot Few ESP32-C3 Products Using Certain ESP-IDF Versions

This bug advisory describes boot problems identified in the ESP32-C3 series of products, including chips, modules, and development boards, developed and produced based on ESP-IDF v4.3-rc and ESP-IDF v4.3. The bug is caused by improper parameter configurations in the chip's initialization software and has been fixed in ESP-IDF v4.3.1 and higher.

V1.0 AR2021-006 Bugs 2021.12.24 Fixed
Security Advisory on "BadAlloc" Vulnerabilities

This security advisory describes BadAlloc, which is a family of vulnerabilities related to integer overflows in heap handling functions in several RTOSes and libraries, and its solutions.

V1.0 AR2021-005 Security 2021.10.27 Fixed
Notice on Invalid KC Certification
V1.0 AR2021-T-001 Other 2021.09.28
Security Advisory for Bluetooth Vulnerability

Securtiy Advisory for various Bluetooth vulnerability, including BrakTooth, Impersonation in different pairing methods and Mesh, BIAS Vulnerability, and their solutions.

V1.0 AR2021-004 Security 2021.08.31 Fixed
Security Advisory Concerning Partitions Using Flash Encryption

This security advisory describes the partition encryption issues and their solutions when using the flash encryption feature of ESP32 series products.

V1.0 AR2021-002 Security 2021.06.10 Fixed
End-of-Life Advisory for ESP-IDF v3.1 and ESP-IDF v3.2 Release Branches

ESP-IDF v3.1 and v3.2 Release Branch reaches End-of-Life in October, 2020.

V1.0 AR2021-001 End-of-Life 2021.03.09 Announcement
Security Advisory concerning fault injection and ESP32 Flash Encryption & Secure Boot V1
V1.0 AR2020-001 Security 2020.07.20 Notification





Advisory type