CVE-2024-55413

High

Published: 07 January 2025

Published

07 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 6.4th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-55413 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Sunix (inferred from references). Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 6.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SC-41 (Port and I/O Device Access) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Requires validation of IOCTL inputs to the snxppamd.sys driver, preventing specially crafted requests from enabling arbitrary I/O port read/write.

SC-41 Port and I/O Device Access good match

prevent

Restricts unauthorized access to I/O ports and devices, directly blocking the arbitrary I/O port read/write exploitation in the vulnerable driver.

SI-2 Flaw Remediation good match

prevent

Mandates timely remediation of the known flaw in snxppamd.sys through patching, disabling, or removal to eliminate privilege escalation and code execution risks.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1553.002 Code Signing Defense Impairment

Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

attack.mitre.org →

Why these techniques?

Vulnerable signed kernel driver directly enables local privilege escalation via arbitrary I/O port access (T1068) and subverts driver code-signing enforcement to load abusive code (T1553.002).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability exits in driver snxppamd.sys in SUNIX Parallel Driver x64 - 10.1.0.0, which allows low-privileged users to read and write arbitary i/o port via specially crafted IOCTL requests . This can be exploited for privilege escalation, code execution under…

high privileges, and information disclosure. These signed drivers can also be used to bypass the Microsoft driver-signing policy to deploy malicious code.

Deeper analysisAI

CVE-2024-55413 is a vulnerability in the snxppamd.sys driver included in the SUNIX Parallel Driver x64 version 10.1.0.0. It enables low-privileged users to read and write arbitrary I/O ports via specially crafted IOCTL requests. This issue, published on 2025-01-07 and associated with CWE-787, carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

A local attacker with low privileges can exploit this vulnerability to achieve privilege escalation, execute code under high privileges, and disclose sensitive information. The driver, being signed, can also bypass Microsoft's driver-signing policy, facilitating the deployment of malicious code.

Details on the vulnerability, including the affected driver, are documented in a GitHub repository at https://github.com/heyheysky/vulnerable-driver/blob/master/CVE-2024-55413/CVE-2024-55413_snxppamd.sys_README.md, with the vendor site available at https://www.sunix.com/tw/. No specific mitigation or patch details are outlined in the provided references.