What the vulnerability does
01Description
A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmware.
CVSS base score
6.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Key dates
02Disclosure timeline
December 14, 2023
CVE published
August 2, 2024
Record updated
External resources
03References
Related vulnerabilities
04Related CVE
CVE-2025-69263 pnpm Lockfile Integrity Bypass Allows Remote Dynamic Dependencies
CVE-2024-33660 Potential Firmware update without integrity check
CVE-2019-3977
CVE-2020-7831
CVE-2016-6564 Ragentek Android software contains an over-the-air update mechanism that communicates over an unencrypted channel, which can allow a remote attacker to execute arbitrary code with root privileges
