CVE-2026-45328
published 2026-06-10CVE-2026-45328: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in…
PriorityP346high8.8CVSS 3.1
AVLACLPRLUINSCCHIHAH
EPSS
0.13%
2.7th percentile
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.4 and 6.0, the esp_tee component exposes secure-service wrappers in esp_secure_services.c and esp_secure_services_iram.c that bridge calls from the user application (i.e. the REE) to TEE-protected hardware peripherals (AES, SHA, ECC, HMAC, SPI, MMU, WDT) and to the security feature like attestation, OTA updates, secure storage. This issue has been patched in versions 5.5.5 and 6.0.1.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
| espressif | esp-idf | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/espressif/esp-idf/commit/145ba4c42dc8283054cfde9a1c3470db7399192fhttps://github.com/espressif/esp-idf/commit/440a5d1906502023f2a0fb0aecbdf0602d14acbfhttps://github.com/espressif/esp-idf/commit/764626a1b7c85b943d207da08a2f8f7d7f3def4dhttps://github.com/espressif/esp-idf/commit/7867f4a57560bf9fc4a931e37ba02b7a3e9f406bhttps://github.com/espressif/esp-idf/commit/afd14ab113acd0ca369965404c99ac42e74d4fcdhttps://github.com/espressif/esp-idf/commit/eebabaff2fdc273b1530fe66e55fb3bcd181dfd6https://github.com/espressif/esp-idf/security/advisories/GHSA-mmgp-73p4-92xp
2026-06-10
Published