Cyber Resilience

CVE-2024-38403

High

Published: 04 November 2024

Published
04 November 2024
Modified
07 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0056 68.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-38403 is a high-severity Buffer Over-read (CWE-126) vulnerability in Qualcomm Wsa8845H Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 31.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Transient DOS while parsing BTM ML IE when per STA profile is not included.

CWE(s)
CWE-126CWE-125

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
Why these techniques?

CVE-2024-38403 enables transient denial of service through exploitation of a parsing vulnerability in BTM ML IE without per STA profile, facilitating endpoint DoS via application or system exploitation.

Affected Assets

qualcomm
wsa8845h firmware
all versions
qualcomm
wsa8845 firmware
all versions
qualcomm
wsa8840 firmware
all versions
qualcomm
wsa8835 firmware
all versions
qualcomm
wsa8832 firmware
all versions
qualcomm
wsa8830 firmware
all versions
qualcomm
wcn7881 firmware
all versions
qualcomm
wcn7880 firmware
all versions
qualcomm
wcn7861 firmware
all versions
qualcomm
wcn7860 firmware
all versions
+68 more product configuration(s) — see NVD for full list

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References