CVE-2017-3225

CVE-2017-3225 describes a vulnerability in the Das U-Boot bootloader, specifically affecting its AES-encrypted configuration file feature. The flaw stems from U-Boot's use of a zero initialization vector (IV) for AES-CBC encryption, which weakens the cryptographic implementation. This medium-severity vulnerability (CVSS 4.6) could allow an attacker to perform dictionary attacks to decrypt sensitive configuration data, though it requires physical access to the device. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.