CVE-2024-9497
Published: 24 January 2025
Summary
CVE-2024-9497 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Silabs (inferred from references). Its CVSS base score is 8.6 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique DLL (T1574.001); ranked at the 15.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-11 (User-installed Software).
Deeper analysis
CVE-2024-9497 is a DLL hijacking vulnerability stemming from an uncontrolled search path in the USBXpress 4 SDK installer from Silicon Labs. This issue, classified under CWE-427, affects systems where the impacted installer is executed and carries a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H).
A local attacker can exploit this vulnerability by placing a malicious DLL in a directory prioritized by the installer's search path ahead of secure locations. Exploitation requires user interaction to run the installer, enabling privilege escalation and arbitrary code execution with high impacts on confidentiality, integrity, and availability, along with a change in scope.
Silicon Labs has published details on this vulnerability in their community advisory at https://community.silabs.com/068Vm00000JUQwd.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50358
Vulnerability details
DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct DLL search order hijacking (CWE-427) in installer enables T1038; results in local privilege escalation and code execution via malicious DLL placement.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Prohibits user installation and execution of unapproved software like the vulnerable USBXpress SDK installer, eliminating the required user interaction for DLL hijacking exploitation.
Requires timely identification, reporting, and correction of flaws such as CVE-2024-9497 in the USBXpress installer to prevent privilege escalation via DLL hijacking.
Enforces deny-all, permit-by-exception policies for software execution, blocking the vulnerable installer and potentially malicious DLLs from running.