CVE-2025-9612

An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections.

CVSS v3 5.1 MEDIUM

5.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 2.5

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://pcisig.com/PCIeIDEStandardVulnerabilities	Vendor Advisory
https://pcisig.com/specifications	Product
https://kb.cert.org/vuls/id/404544	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pcisig:pci_express_integrity_and_data_encryption:-:*:*:*:*:*:*:*

History

14 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Se descubrió un problema en la especificación PCI?Express (PCIe) Integrity and Data Encryption (IDE), donde la orientación insuficiente sobre la ordenación de los Transaction?Layer?Packet (TLP) y la unicidad de etiquetas puede permitir que los paquetes cifrados sean retransmitidos o reordenados sin detección. Esto puede habilitar a atacantes locales o físicos en el bus PCIe a violar las protecciones de integridad de datos.

Information

Published : 2025-12-09 19:15

Updated : 2026-10-14 21:10

NVD link : CVE-2025-9612

Mitre link : CVE-2025-9612

CVE.ORG link : CVE-2025-9612

JSON object : View

Products Affected

pcisig

pci_express_integrity_and_data_encryption

CWE

NVD-CWE-noinfo

{"id": "CVE-2025-9612", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9612", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-11T14:57:05.743440Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.5}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "PCI-SIG", "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification", "versions": [{"status": "affected", "version": "0", "lessThan": "7.1-Rev7.0", "versionType": "custom"}]}, {"vendor": "PCI-SIG", "product": "PCI Express Integrity and Data Encryption (PCIe IDE) Specification", "versions": [{"status": "affected", "version": "0", "lessThan": "6.5-Rev7.0", "versionType": "custom"}]}]}], "published": "2025-12-09T19:15:50.730", "references": [{"url": "https://pcisig.com/PCIeIDEStandardVulnerabilities", "tags": ["Vendor Advisory"], "source": "cret@cert.org"}, {"url": "https://pcisig.com/specifications", "tags": ["Product"], "source": "cret@cert.org"}, {"url": "https://kb.cert.org/vuls/id/404544", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "An issue was discovered in the PCI Express (PCIe) Integrity and Data Encryption (IDE) specification, where insufficient guidance on Transaction Layer Packet (TLP) ordering and tag uniqueness may allow encrypted packets to be replayed or reordered without detection. This can enable local or physical attackers on the PCIe bus to violate data integrity protections."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en la especificaci\u00f3n PCI?Express (PCIe) Integrity and Data Encryption (IDE), donde la orientaci\u00f3n insuficiente sobre la ordenaci\u00f3n de los Transaction?Layer?Packet (TLP) y la unicidad de etiquetas puede permitir que los paquetes cifrados sean retransmitidos o reordenados sin detecci\u00f3n. Esto puede habilitar a atacantes locales o f\u00edsicos en el bus PCIe a violar las protecciones de integridad de datos."}], "lastModified": "2026-10-14T21:10:00.183", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pcisig:pci_express_integrity_and_data_encryption:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5FC26D98-4F15-4B0D-B661-BF2894CF8F5B"}], "operator": "OR"}]}], "sourceIdentifier": "cret@cert.org"}