CVE-2024-10239 HIGH

CVE-2024-10239: fld->used_bytes without sanity check causes stack overflow

Vendor Smci

Product MBD-X12DPG-OA6

Weakness CWE-121

Published February 4, 2025

Last update February 4, 2025

View on NVD All CVEs

CVSS base score

7.2/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat->fsd.max_fld.

Key dates

02Disclosure timeline

February 4, 2025 CVE published

February 4, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10239 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/121.html

Related vulnerabilities

04Related CVE

CVE-2022-20702 Cisco Small Business RV Series Routers Vulnerabilities CVE-2020-37119 Nsauditor 3.2.1.0 - Buffer Overflow (SEH+ASLR bypass (3 bytes overwrite)) CVE-2019-0053 Junos OS: Insufficient validation of environment variables in telnet client may lead to stack-based buffer overflow CVE-2023-51613 D-Link DIR-X3260 prog.cgi SetDynamicDNSSettings Stack-Based Buffer Overflow Remote Code Execution Vulnerability CVE-2026-5550 Tenda AC10 httpd fromSysToolChangePwd stack-based overflow