CVE-2024-33659
Published: 11 February 2025
Summary
CVE-2024-33659 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Ami Aptio V. Its CVSS base score is 5.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-33659 is an improper input validation vulnerability (CWE-20) in the AMI APTIOV BIOS firmware. It affects systems utilizing this BIOS component, where flawed validation allows attackers to manipulate inputs during local operations.
A local attacker with low privileges (AV:L/AC:L/PR:L) can exploit the vulnerability without user interaction (UI:N). Successful exploitation enables overwriting arbitrary memory and executing arbitrary code at the System Management Mode (SMM) level, with a changed scope (S:C) that grants high-impact privileges, compromising confidentiality, integrity, and availability (CVSS:3.1 score of 8.8: C:H/I:H/A:H).
AMI security advisory AMI-SA-2025002 details the issue and is available at https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2025/AMI-SA-2025002.pdf for mitigation guidance and patching information.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-31375
Vulnerability details
AMI APTIOV contains a vulnerability in BIOS where an attacker may cause an Improper Input Validation by a local attacker. Successful exploitation of these vulnerabilities may lead to overwriting arbitrary memory and execute arbitrary code at SMM level, also impacting…
more
Confidentiality, Integrity, and Availability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local input validation flaw in BIOS firmware directly enables arbitrary SMM code execution from low-privileged context, mapping to privilege escalation via system firmware abuse.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces information input validation mechanisms to mitigate the improper input validation vulnerability (CWE-20) in the AMI APTIOV BIOS firmware.
Ensures timely identification, reporting, and remediation of the BIOS firmware flaw via patching as detailed in the AMI security advisory.
Monitors and verifies the integrity of BIOS firmware to prevent unauthorized modifications and detect exploitation attempts leading to arbitrary code execution at SMM level.