CVE-2024-32632
Asrmicro Asr1803Sc Firmware ≤ cp01.057.067
Raw vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-32632 is a medium-severity Function Call With Incorrect Argument Type (CWE-686) vulnerability in Asrmicro Asr1803Sc Firmware. Its CVSS base score is 6.6 (Medium).
Operationally, ranked at the 13th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-30434
Vulnerability Data
A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover function calls that pass arguments of incorrect type.
Requiring documented development standards and tools can mandate strong typing, static analysis, or compiler checks that stop type-mismatch errors from being introduced.
Security engineering principles can include use of type-safe languages and interfaces that structurally prevent incorrect argument types.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices (static analysis, code review, typed APIs, testing) directly prevent incorrect-argument calls while this single weakness addresses only a narrow slice of the control's broader intent.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect type-related defects through unit, integration, and static-analysis testing.
Secure development life cycle includes coding standards and reviews that can catch type-mismatch errors.
Application security requirements can mandate strong typing and interface contracts that prevent incorrect argument types.
Secure system architecture and engineering principles promote type-safe designs and interface definitions.
Secure coding directly addresses type safety, static analysis, and compiler warnings for argument mismatches.