CVE-2022-47549: trustedfirmware op-tee
Vulnerability summary
CVE-2022-47549 is a medium (CVSS 6.4) vulnerability in trustedfirmware op-tee. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 34.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 19-12-2022PublishedVulnerability first disclosed.
- 17-04-2025Last modifiedVulnerability information updated.
Description
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST6.4MediumCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
35%
Versus all other CVEs
30-day change
+0.02 pp
From 0.40% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (people.linaro.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Trustedfirmware1 product
- op-tee< 3.20
1 vendor · 1 product
References
2 links- github.com/OP-TEE/optee_os/security/advisories/GHSA-r64m-h886-hw6gThird Party Advisory