CVE-2025-68622
📋 TL;DR
A stack buffer overflow vulnerability in Espressif ESP-IDF USB Host UVC Class Driver allows malicious USB cameras to corrupt memory during configuration-descriptor parsing. This affects systems using ESP-IDF with USB host functionality and UVC descriptor printing enabled. Attackers could potentially execute arbitrary code or crash the system.
💻 Affected Systems
- Espressif ESP-IDF USB Host UVC Class Driver
- Devices using esp-usb UVC host implementation
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, device takeover, or persistent backdoor installation.
Likely Case
System crash, denial of service, or limited memory corruption affecting USB functionality.
If Mitigated
No impact if UVC configuration-descriptor printing is disabled or patched version is used.
🎯 Exploit Status
Exploitation requires physical USB device connection with specially crafted UVC descriptor. No authentication needed once device is connected.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.0
Vendor Advisory: https://github.com/espressif/esp-usb/security/advisories/GHSA-g65h-9ggq-9827
Restart Required: Yes
Instructions:
1. Update esp-usb component to version 2.4.0 or later. 2. Update ESP-IDF if using bundled version. 3. Rebuild and flash firmware. 4. Restart affected devices.
🔧 Temporary Workarounds
Disable UVC descriptor printing
allDisable the vulnerable configuration-descriptor printing functionality
Set CONFIG_USB_HOST_UVC_PRINT_DESC=n in sdkconfig
🧯 If You Can't Patch
- Disable USB host functionality or restrict physical USB port access
- Implement USB device whitelisting or use USB condoms to prevent unauthorized devices
🔍 How to Verify
Check if Vulnerable:
Check esp-usb component version: grep -r 'usb_host_uvc' components/espressif/usb_host_uvc/idf_component.ymlCheck Version:
grep 'version:' components/espressif/usb_host_uvc/idf_component.ymlVerify Fix Applied:
Verify version >=2.4.0: cat components/espressif/usb_host_uvc/idf_component.yml | grep version📡 Detection & Monitoring
Log Indicators:
- USB device connection errors
- UVC descriptor parsing failures
- System crashes after USB device insertion
Network Indicators:
- None - local USB attack vector
SIEM Query:
source="esp32_logs" AND ("USB" AND ("crash" OR "overflow" OR "UVC"))