CVE-2024-45569
Published: 03 February 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2024-45569 is a memory corruption vulnerability stemming from improper validation of array index (CWE-129) while parsing the ML IE due to invalid frame content. It affects components in Qualcomm products, as documented in the vendor's February 2025 security bulletin.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network by unauthenticated attackers requiring low complexity and no user interaction. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, such as arbitrary code execution or system compromise.
Qualcomm's February 2025 security bulletin at https://docs.qualcomm.com/product/publicresources/securitybulletin/february-2025-bulletin.html details affected products and provides guidance on patches or mitigations. Security practitioners should consult this advisory for specific remediation steps.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Memory corruption vulnerability in parsing malformed ML IE in wireless frames enables remote exploitation for privilege escalation (e.g., kernel/driver RCE) or endpoint denial of service via application/system crash.