CVE-2024-9499

High

Published: 24 January 2025

Published

24 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0001 2.5th percentile

Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-9499 is a high-severity Uncontrolled Search Path Element (CWE-427) vulnerability in Silabs (inferred from references). Its CVSS base score is 8.6 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique DLL Search Order Hijacking (T1038); ranked at the 2.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-10 (Software Usage Restrictions) and CM-11 (User-installed Software).

Threat & Defense at a Glance

What attackers do: exploitation maps to DLL Search Order Hijacking (T1038) and 1 other technique. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

CM-11 User-installed Software good match

prevent

Restricts and approves user-installed software, preventing execution of vulnerable installers like the USBXpress Win 98SE Dev Kit that suffer from DLL hijacking.

CM-14 Signed Components good match

prevent

Requires digital signatures for software components such as DLLs prior to installation and execution, blocking malicious unsigned DLLs loaded via uncontrolled search paths.

CM-10 Software Usage Restrictions good match

prevent

Implements deny-all, permit-by-exception policies for software execution, preventing the vulnerable installer and any malicious DLLs from running.

MITRE ATT&CK Enterprise TechniquesAI

T1038 DLL Search Order Hijacking Persistence

Windows systems use a common method to look for required DLLs to load into a program.

attack.mitre.org →

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Direct DLL Search Order Hijacking via uncontrolled search path in installer enables local privilege escalation and arbitrary code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary code execution when running the impacted installer.

Deeper analysisAI

CVE-2024-9499 is a DLL hijacking vulnerability caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer. This issue, classified under CWE-427, affects the installer for this development kit from Silicon Labs and can lead to privilege escalation and arbitrary code execution when the impacted installer is executed. The vulnerability has a CVSS v3.1 base score of 8.6 (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), highlighting its high severity due to the potential for significant impact with low attack complexity.

A local attacker can exploit this vulnerability by placing a malicious DLL in a directory included in the installer's search path, which is searched before secure locations. Exploitation requires no special privileges (PR:N) but depends on user interaction (UI:R), such as a victim running the installer. Upon success, the attacker achieves privilege escalation and arbitrary code execution with high scope change, compromising confidentiality, integrity, and availability.

Silicon Labs has published details on this vulnerability in their community advisory at https://community.silabs.com/068Vm00000JUQwd, which security practitioners should consult for recommended mitigations and patches.