Security Version Number Mutable to Older Versions

The security version number in the hardware product is mutable, resulting in the ability to downgrade (roll-back) the boot firmware to vulnerable code versions.

We track 1 vulnerability of this type. 100% are rated high or critical, and the average CVSS score is 7.5.

How this weakness is prevented

• Architecture and Design: The security version number must be stored securely and persistently across power-on resets. When architecting the system, security version data should be designated for storage in registers that are either read-only or have access controls that prevent modification by an untrusted agent.
• Implementation: During implementation and test, security version data should be demonstrated to be read-only and access controls should be validated.