CVE-2024-39792
F5 Nginx Plus r30 … r32
Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-39792 is a high-severity Expired Pointer Dereference (CWE-825) vulnerability in F5 Nginx Plus. Its CVSS base score is 8.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 47th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and IA-5 (Authenticator Management) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38237
Vulnerability Data
When the NGINX Plus is configured to use the MQTT pre-read module, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 1 hardening rule · 1 OS baseline
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement applies current authorizations to every request, directly blocking operations once a resource has been revoked or released.
Authenticator management mandates revocation and replacement procedures that render expired credentials unusable.
Developer testing and evaluation (including fuzzing, static analysis, and dynamic memory checkers) directly finds expired-pointer dereferences before deployment.
Account lifecycle management includes explicit revocation and disabling steps that stop subsequent operations on released accounts or identifiers.
Identifier management requires deallocation and reuse controls that prevent continued use of released identifiers.
Secure engineering principles applied during design and implementation can mandate memory-safe allocation, ownership, and deallocation patterns that structurally avoid use of expired pointers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing managed authorizations and revocations directly prevents post-release operations on credentials or entitlements.
Secure-development practices directly prevent coding errors such as use-after-free while one CWE contributes only modestly to the full control.
Lifecycle management includes secure development and maintenance phases that reduce memory-safety defects.
Vulnerability identification processes can discover use-after-free flaws via scanning or analysis.
Routine patching and replacement can eliminate known instances of expired-pointer bugs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect use-after-free issues, but removing this weakness alone does not fulfill the testing control.
Enforces timely deletion of resources so they cannot be used after release.
Secure development lifecycle practices can include pointer lifetime and memory-management rules that reduce expired-pointer dereferences.
Application security requirements may mandate safe memory handling, but eliminating this single weakness does not satisfy the broader requirement.
Secure architecture and engineering principles can prescribe memory-safety patterns, yet fixing only this weakness does not achieve the control.
Secure coding standards directly address pointer lifetime and deallocation discipline, substantially mitigating expired-pointer dereference.