CVE-2024-23613
Published: 26 January 2024
Summary
CVE-2024-23613 is a critical-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Broadcom Symantec Deployment Solutions. Its CVSS base score is 10.0 (Critical).
Operationally, ranked in the top 7.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 during parsing of UpdateComputer tokens. The flaw, tracked under CWE-119 and CWE-120, resides in the axengine.exe component and carries a CVSS 3.1 score of 10.0, reflecting network-accessible attack conditions with no required authentication or user interaction and full impact across confidentiality, integrity, and availability in a changed scope.
A remote anonymous attacker can send crafted UpdateComputer tokens to trigger the overflow, resulting in arbitrary code execution with SYSTEM privileges on the affected system. The published description and associated technical analysis confirm the attack requires only network connectivity to the Deployment Solution service.
The provided references consist of detailed exploit research published concurrently with disclosure but contain no information on vendor patches, workarounds, or official mitigation guidance. The EPSS score has remained flat at 0.0765 with no material increase since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21107
Vulnerability details
A buffer overflow vulnerability exists in Symantec Deployment Solution version 7.9 when parsing UpdateComputer tokens. A remote, anonymous attacker can exploit this vulnerability to achieve remote code execution as SYSTEM.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Managed runtimes used by platform-independent applications (e.g., JVM, CLR) enforce memory safety, preventing most buffer overflows that require direct memory manipulation.
Ongoing control assessments and code testing (static/dynamic analysis, fuzzing) surface memory buffer restriction failures, which are then remediated before release.
Memory protections (e.g., W^X, ASLR) make exploitation of buffer-boundary violations far harder to turn into code execution.
Detects exploitation attempts that produce memory corruption, crashes, or anomalous behavior.