CVE-2024-43554
Published: 08 October 2024
Summary
CVE-2024-43554 is a medium-severity Improper Removal of Sensitive Information Before Storage or Transfer (CWE-212) vulnerability in Microsoft Windows 10 1507. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 49.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-40310
Vulnerability details
Windows Kernel-Mode Driver Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Eradication of spilled information from contaminated systems mitigates the effects of improper removal of sensitive data before storage or transfer.
The control requires verified removal of sensitive data before media is made available at a reduced classification level, directly addressing improper removal prior to storage or transfer.
Explicit procedures to delete inaccurate or outdated PII directly mitigate improper removal of sensitive information before storage or transfer.
Retention policies enforce removal or sanitization of sensitive data before storage or transfer per regulatory requirements.
The explicit requirement to delete inaccurate/outdated PII implements proper removal of sensitive information before further storage or transfer.
The control implements proper removal of sensitive information before storage or transfer of datasets.
The generate-on-demand-and-delete requirement enforces removal of sensitive information before storage or transfer, preventing improper retention.
Requires explicit removal of sensitive information prior to component transfer or disposal, reducing exposure from retained data.