CVE-2024-55411

High

Published: 07 January 2025

Published

07 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0016 36.2th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55411 is a high-severity Incorrect Permission Assignment for Critical Resource (CWE-732) vulnerability in Sunix (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 36.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

Directly requires remediation of known flaws like CVE-2024-55411 by patching or removing the vulnerable snxpcamd.sys kernel driver to prevent arbitrary kernel memory read/write.

CM-7 Least Functionality good match

prevent

Prohibits or restricts unnecessary functions such as loading vulnerable third-party drivers like snxpcamd.sys unless essential, minimizing exposure to IOCTL exploitation.

CM-6 Configuration Settings good match

prevent

Enforces secure baseline configuration settings to block vulnerable drivers via allowlisting, denylisting, or disabling IOCTL interfaces in snxpcamd.sys.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Kernel driver IOCTL flaw enabling arbitrary kernel memory R/W directly facilitates local privilege escalation to SYSTEM.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

An issue in the snxpcamd.sys component of SUNIX Multi I/O Card v10.1.0.0 allows attackers to perform arbitrary read and write actions via supplying crafted IOCTL requests.

Deeper analysisAI

CVE-2024-55411 is a vulnerability in the snxpcamd.sys kernel driver component of the SUNIX Multi I/O Card version 10.1.0.0. The issue enables attackers to perform arbitrary read and write operations on kernel memory by supplying crafted IOCTL requests to the driver. It has been assigned a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-732 (Incorrect Permission Assignment for Critical Resource), indicating improper handling of permissions in a critical system resource.

The vulnerability is exploitable over the network by an attacker possessing low privileges on the target system, with low complexity and no requirement for user interaction. Exploitation allows arbitrary kernel memory manipulation, resulting in high-impact confidentiality, integrity, and availability violations, such as privilege escalation, code execution, or system crashes.

Advisories and further details are documented in a GitHub repository at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55411/CVE-2024-55411_snxpcamd.sys_README.md, with the vendor SUNIX providing related information at https://www.sunix.com/tw/. No specific patch or mitigation guidance is outlined in the published disclosure as of the CVE publication date of 2025-01-07.