CVE-2024-7726

CVE-2024-7726 describes an unauthenticated JTAG debug port vulnerability affecting Kioxia CM6, PM6, and PM7 solid-state drives. An attacker with temporary physical access can exploit this port, which is accessible without opening the drive enclosure, to gain full control over the firmware and memory of the main CPU cores. This allows for arbitrary code execution, modification of firmware, and bypassing signature verification during boot-up. Rated with a CVSS score of 6.8 (Medium), the vulnerability has a physical attack vector (AV:P) and low attack complexity (AC:L), leading to high impacts on confidentiality, integrity, and availability (C:H, I:H, A:H). Despite the potential for complete system compromise, the EPSS score is very low, indicating a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this vulnerability. It is not listed in CISA's Known Exploited Vulnerabilities catalog.