Cyber Resilience

CVE-2024-32634

Asrmicro Asr3603 Firmware ≤ cp01.057.067

Published
16 April 2024
Modified
10 December 2025
Patch / advisory
View advisory
CVSS Score v3.1 6.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
EPSS Score 0.0027 18th percentile
Risk Priority 44 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-32634 is a medium-severity Dead Code (CWE-561) vulnerability in Asrmicro Asr3603 Firmware. Its CVSS base score is 6.1 (Medium).

Operationally, ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

In huge memory get unmapped area check, code can never be reached because of a logical contradiction.

CWE(s)
CWE-561

Related Threats

CVEs Like This One

CVE-2024-32625Same product: Asrmicro Asr1602
CVE-2024-32631Same product: Asrmicro Asr1602
CVE-2024-32633Same product: Asrmicro Asr1602
CVE-2024-32632Same product: Asrmicro Asr1602
CVE-2023-49701Same product: Asrmicro Asr1803
CVE-2023-49699Same product: Asrmicro Asr1803
CVE-2023-49700Same product: Asrmicro Asr1803
CVE-2026-42799Same product: Asrmicro Asr1803
CVE-2025-49488Same product: Asrmicro Asr1803
CVE-2025-49490Same product: Asrmicro Asr1803

Affected Assets

asrmicro
asr3603 firmware
≤ cp01.057.067
asrmicro
asr1607 firmware
≤ cp01.057.067
asrmicro
asr1803sc firmware
≤ cp01.057.067
asrmicro
asr3602 firmware
≤ cp01.057.067
asrmicro
asr3605 firmware
≤ cp01.057.067
asrmicro
asr3607 firmware
≤ cp01.057.067
asrmicro
asr1609 firmware
≤ cp01.057.067
asrmicro
asr1605 firmware
≤ cp01.057.067
asrmicro
asr1602 firmware
≤ cp01.057.067
asrmicro
asr1603 firmware
≤ cp01.057.067
+3 more product configuration(s) — see NVD for full list

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation activities can employ static analysis or code-coverage tools that identify unreachable code paths.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities such as static analysis and code review directly detect and eliminate unreachable code.

PR.PS-02 partial match
prevents

Routine software maintenance can incidentally remove dead code but does not target it as a security or quality practice.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can surface dead code but does not directly prevent or eliminate it.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC mandates code reviews and static analysis that detect and remove unreachable code.

A.8.28 Secure coding partial match
prevents

Secure coding standards require removal of dead code to improve maintainability and reduce attack surface.

A.8.32 Change management partial match
finds

Change-management processes may catch dead code during reviews but are not designed to address it.

References