CVE-2024-24424

HighDDoS

Published: 21 January 2025

Published

21 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Score 0.0019 41.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-24424 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability in Cellularsecurity (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 41.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2024-24424 is a vulnerability involving a reachable assertion in the decode_access_point_name_ie function of Magma versions up to and including 1.8.0. Magma, an open-source software platform for building access gateways and core network functions in cellular networks, is affected. The issue, classified under CWE-400 (Uncontrolled Resource Consumption), enables a Denial of Service (DoS) condition when processing a crafted NAS (Non-Access Stratum) packet. It received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.

The vulnerability can be exploited by unauthenticated attackers with network access to the affected Magma instance. Exploitation requires low complexity and no user interaction, allowing remote attackers to send a specially crafted NAS packet that triggers the assertion failure, resulting in a service crash or denial of service. No privileges, confidentiality, or integrity impacts are possible, but the high availability disruption targets critical cellular network components.

Mitigation is available in Magma version 1.9 via commit 08472ba98b8321f802e95f5622fa90fec2dea486, which addresses the assertion issue. Security practitioners should upgrade to this fixed version and review the advisory at https://cellularsecurity.org/ransacked for additional details on the patch and affected deployments.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2024-21843

Vulnerability details

A reachable assertion in the decode_access_point_name_ie function of Magma <= 1.8.0 (fixed in v1.9 commit 08472ba98b8321f802e95f5622fa90fec2dea486) allows attackers to cause a Denial of Service (DoS) via a crafted NAS packet.

CWE(s): CWE-400

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact

Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

attack.mitre.org →

Why these techniques?

Direct remote exploitation of the assertion flaw in a network-exposed service (Magma) to trigger crash/DoS via crafted packet matches T1499.004 Application or System Exploitation.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1