Lucene search

MicrochipCVE-2024-7490

HistoryAug 08, 2024 - 3:15 p.m.

CVE-2024-7490

2024-08-0815:15:19

CWE-120

CWE-20

Microchip

web.nvd.nist.gov

vulnerability

input validation

microchip technology

dhcp server

remote code execution

buffer overflow

advanced software framework

program files

workaround

migration

unsupported software

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer overflow.
This vulnerability is associated with program files tinydhcpserver.C and program routines lwip_dhcp_find_option.

This issue affects Advanced Software Framework: through 3.52.0.2574.

ASF is no longer being supported. Apply provided workaround or migrate to an actively maintained framework.

Affected configurations

Nvd

Node

microchipadvanced_software_frameworkRange≤3.52.0.2574

VendorProductVersionCPE
microchipadvanced_software_framework*cpe:2.3:a:microchip:advanced_software_framework:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microchip	advanced_software_framework	*	cpe:2.3:a:microchip:advanced_software_framework::::::::

CNA Affected

[
  {
    "collectionURL": "https://gallery.microchip.com/packages/4CE20911-D794-4550-8B94-6C66A93228B8/",
    "defaultStatus": "affected",
    "modules": [
      "network"
    ],
    "packageName": "lwip",
    "product": "Advanced Software Framework",
    "programFiles": [
      "tinydhcpserver.c"
    ],
    "programRoutines": [
      {
        "name": "lwip_dhcp_find_option"
      }
    ],
    "repo": "https://savannah.nongnu.org/projects/lwip/",
    "vendor": "Microchip Techology",
    "versions": [
      {
        "lessThanOrEqual": "3.52.0.2574",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

References

www.microchip.com/en-us/tools-resources/develop/libraries/advanced-software-framework

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS4

9.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/SC:H/VI:H/SI:H/VA:H/SA:H

AI Score

7.6

Confidence

High

EPSS

0.001

Percentile

39.1%

JSON

Related for CVE-2024-7490