Cyber Resilience

CVE-2024-33453

High

Published: 17 October 2024

Published
17 October 2024
Modified
31 December 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.1219 94.0th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-33453 is a high-severity Classic Buffer Overflow (CWE-120) vulnerability in Espressif Esp-Idf. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Account Discovery (T1087); ranked in the top 6.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2024-33453 is a buffer overflow vulnerability, tracked as CWE-120, that affects the externalId component in Espressif esp-idf version 5.1. The flaw received a CVSS 3.1 score of 8.1 and permits memory corruption that can expose sensitive data.

An attacker with network access and low privileges can trigger the overflow remotely without user interaction, achieving high confidentiality and integrity impact while leaving availability unaffected. This allows unauthorized retrieval of sensitive information and potential data manipulation within the affected ESP-IDF environment.

The sole public reference points to a GitHub repository containing further technical details on the issue, though no official patch notes or mitigation steps are provided in the available sources. The associated EPSS score reached a peak of 0.1643 and currently stands at 0.1219, reflecting a moderate rise in exploitation interest after disclosure.

EU & UK References

Vulnerability details

Buffer Overflow vulnerability in esp-idf v.5.1 allows a remote attacker to obtain sensitive information via the externalId component.

CWE(s)
CWE-120

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1087 Account Discovery Discovery
Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment.
attack.mitre.org →
T1213 Data from Information Repositories Collection
Adversaries may leverage information repositories to mine valuable information.
attack.mitre.org →
Why these techniques?

The IDOR vulnerability (improper object-level access control) enables authenticated attackers to enumerate and access other users' sensitive information by manipulating the 'id' parameter in the user search endpoint, facilitating Account Discovery (T1087) and Data from Information Repositories (T1213).

Affected Assets

espressif
esp-idf
5.1

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-27 Platform-independent Applications
addresses: CWE-120

Platform-independent managed code eliminates the need for unchecked native buffer copies that are the root cause of classic buffer overflows.

References