Cyber Resilience

CVE-2024-33063

High

Published: 02 December 2024

Published
02 December 2024
Modified
12 December 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0029 53.1th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-33063 is a high-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Qualcomm Ar8035 Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 46.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Transient DOS while parsing the ML IE when a beacon with common info length of the ML IE greater than the ML IE inside which this element is present.

CWE(s)
CWE-190

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

The vulnerability enables transient denial of service on endpoints parsing malformed ML IE in wireless beacons via application or system exploitation.

MITRE ATLAS TechniquesAI

MITRE ATLAS techniques

AML.T0048: External Harms

Affected Assets

qualcomm
ar8035 firmware
all versions
qualcomm
fastconnect 6900 firmware
all versions
qualcomm
fastconnect 7800 firmware
all versions
qualcomm
immersive home 3210 platform firmware
all versions
qualcomm
immersive home 326 platform firmware
all versions
qualcomm
ipq5300 firmware
all versions
qualcomm
ipq5312 firmware
all versions
qualcomm
ipq5332 firmware
all versions
qualcomm
ipq9008 firmware
all versions
qualcomm
ipq9554 firmware
all versions
+114 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References