CVE-2024-5477
Raw vector
CVSS:4.0/AV:P/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2024-5477 is a high-severity Improper Restriction of Software Interfaces to Hardware Features (CWE-1256) vulnerability in Hp (inferred from references). Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Firmware Corruption (T1495); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54878
Vulnerability Data
A potential security vulnerability has been identified in the System BIOS for some HP PC products which may allow escalation of privilege, arbitrary code execution, denial of service, or information disclosure via a physical attack that requires specialized equipment and…
more
knowledge. HP is releasing firmware mitigation for the potential vulnerability.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.2.5
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly stops unauthorized software from reaching hardware registers or side-channel interfaces.
Least privilege restricts which processes may invoke power/clock or other hardware-control functions.
Least functionality disables or removes unnecessary software interfaces that expose hardware features.
Hardware-enforced write protection and procedures limit software modification of protected hardware bits.
Process isolation keeps untrusted code from directly manipulating hardware memory or registers.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
ID.RA-01 can surface the hardware-interface flaw during architecture review or testing (partial forward) but supplies no design or implementation restrictions that actually eliminate the root weakness (none reverse).
PR.PS-01's least-functionality baselines can partially limit exposure to risky hardware interfaces when they are configurable, but CWE-1256 is a design-level failure to implement proper restrictions that config management alone does not prevent.
ID.AM-08's generic lifecycle-management guidance has no direct bearing on hardware-interface restriction defects, so neither direction removes or mitigates CWE-1256.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure coding practices can enforce input validation and capability checks on hardware-control APIs, reducing the likelihood of unintended register or memory changes.
Security testing in development can detect and remediate improper hardware interface exposure before deployment.
Restricting privileged utility programs limits exposure of low-level hardware interfaces that could be abused for memory or register manipulation.
Privileged access rights limit who can invoke hardware-control interfaces, reducing the attack surface for unauthorized register/memory manipulation.
Secure system architecture and engineering principles require hardware abstraction layers and access mediation that directly address improper exposure of hardware features.
Information access restriction can enforce least-privilege access to hardware feature APIs, mitigating the risk of side-channel or memory/register tampering.