CVE-2024-29155

Oct. 16, 2024, 4:38 p.m.

4.3
Medium

Description

On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, causing the pair request to be blocked.

Product(s) Impacted

Product Versions
Microchip RN4870 devices

Weaknesses

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References

https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/SoftwareLibraries/Firmware/RN4870-71-Firmware-1.44.zip
https://www.microchip.com/en-us/product/rn4870

Tags

CWE-20
dc3f6da9-85b5-4a73-84a2-2ec90b40fca5
2024-10-16
CVE-2024-29155

CVSS Score

4.3 / 10

CVSS Data

  • Attack Vector: ADJACENT_NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: NONE
  • Integrity Impact: NONE
  • Availability Impact: LOW
    • View Vector String

    CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Date

  • Published: Oct. 16, 2024, 4:15 p.m.
  • Last Modified: Oct. 16, 2024, 4:38 p.m.

Status : Awaiting Analysis

CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

More info

Source

dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.