CVE-2020-10648: n/a vulnerability

CVE-2020-10648: Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbi...

Das U-Boot through 2020.01 allows attackers to bypass verified boot restrictions and subsequently boot arbitrary images by providing a crafted FIT image to a system configured to boot the default configuration.

UnknownCVSS not scoredNot KEV-listedUpdatedMay 12, 2026, 10:12 UTC (UTC+00:00)

Security readout for executives and security teams

CVE-2020-10648 is a verified boot bypass in Das U-Boot through 2020.01. On affected systems configured to boot a default FIT configuration, an attacker who can supply a crafted boot image may boot arbitrary code despite verified boot controls. Most relevant exposure is embedded, appliance, industrial, or IoT platforms using Das U-Boot verified boot with FIT images and default configuration boot behavior. The bundle does not enumerate affected products; Siemens and openSUSE advisories indicate downstream vendor relevance. Prioritize systems where verified boot protects critical appliances, industrial devices, or exposed update workflows. This is not listed as actively exploited in the bundle, but compromise would undermine a foundational trust control. Mitigation focus: Check vendor firmware advisories for fixed bootloader or platform firmware updates.; Inventory products using Das U-Boot through 2020.01 with verified boot enabled.; Review whether FIT images boot using a default configuration on affected devices..

Prepared: Jun 6, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-10648 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Mar 19, 2020, 13:36 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

3Timeline events

2ADP providers

4Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
Mar 17, 2020, 00:00 UTC (UTC+00:00)
CVE publishedCVE Program
The CVE record was published.
Mar 19, 2020, 13:36 UTC (UTC+00:00)
CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
May 12, 2026, 10:12 UTC (UTC+00:00)

ADP provider summaries

Source materials

CVE List V5 sourceCVE List V5
https://github.com/u-boot/u-boot/commits/masterCVE reference, mitre · x_refsource_MISC
https://labs.f-secure.com/advisories/das-u-boot-verified-boot-bypass/CVE reference, mitre · x_refsource_MISC
https://cert-portal.siemens.com/productcert/html/ssa-577017.htmlCVE reference, siemens-SADP

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

n/an/an/aListed

Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.