Security readout for executives and security teams
Plain-English summary
A flaw in Arm Trusted Firmware-M through 1.2 can let non-secure code disrupt secure firmware interactions, potentially halting a device or mishandling secure data. It matters most for embedded products built on TF-M. CISA KEV status raises urgency, but the provided sources do not describe exploitation details or a specific public exploit path.
Executive priority
Prioritize as high where affected embedded devices support important operations or are difficult to patch. The CVSS score is medium, but KEV listing means real-world exploitation is reported. The main business risk is device disruption and possible secure-data mishandling in products relying on vulnerable TF-M firmware.
Technical view
CVE-2021-27562 is reported as CWE-787 in TF-M through 1.2. When secure functions are called under NSPE handler mode, the non-secure world may trigger system halt, secure-data overwrite, or secure-data printing. CVSS 3.1 is 5.5 with local access, low complexity, low privileges, no user interaction, and high availability impact.
Likely exposure
Exposure is likely limited to embedded or IoT products whose firmware includes Arm Trusted Firmware-M through version 1.2. Inventory confidence may be low without firmware SBOMs, vendor advisories, or direct firmware analysis. The bundle does not identify specific downstream devices or CPEs.
Exploitation context
CISA KEV marks this CVE as known exploited, so treat it as actively exploited. The provided evidence does not describe exploitation campaigns, affected device models, public exploit tooling, or whether exploitation requires additional product-specific conditions beyond local low-privilege access.
Researcher notes
The source bundle names TF-M through 1.2 and NSPE handler mode secure-function calls, but lacks downstream product mapping and patch-version detail. Avoid assuming all Arm-based devices are affected. Focus research on firmware composition, TF-M integration, and vendor-specific advisory correlation.
Mitigation direction
- Identify products and firmware images using Arm Trusted Firmware-M through 1.2.
- Check Arm and TrustedFirmware advisories for fixed versions and integration guidance.
- Request downstream vendor firmware updates for affected embedded devices.
- Prioritize internet-managed, safety-critical, or hard-to-recover devices.
- Apply compensating access controls where firmware updates are unavailable.
Validation and detection
- Confirm TF-M version from SBOMs, build manifests, or vendor firmware disclosures.
- Ask vendors whether CVE-2021-27562 is present in shipped firmware.
- Verify remediation by confirming updated TF-M or vendor-patched firmware.
- Review device logs for unexplained halts or secure-service failures.
- Track CISA KEV due-date obligations if your organization is in scope.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-787: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-27562 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.5 (3.1)
- Known Exploited
- Yes
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CISA KEV status
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H1.83.6Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://developer.arm.com/support/arm-security-updatesCVE reference · x_refsource_MISC
- https://git.trustedfirmware.org/TF-M/trusted-firmware-m.git/tree/docs/security/security_advisories/svc_caller_sp_fetching_vulnerability.rstCVE reference · x_refsource_CONFIRM
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-27562CVE reference · government-resource
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Out-of-bounds Write
Out-of-bounds Write represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.