A vital security flaw has been disclosed within the Microchip Superior Software program Framework (ASF) that, if efficiently exploited, might result in distant code execution.
The vulnerability, tracked as CVE-2024-7490, carries a CVSS rating of 9.5 out of a most of 10.0. It has been described as a stack-based overflow vulnerability in ASF’s implementation of the tinydhcp server stemming from a scarcity of sufficient enter validation.
“There exists a vulnerability in all publicly obtainable examples of the ASF codebase that permits for a specifically crafted DHCP request to trigger a stack-based overflow that would result in distant code execution,” CERT Coordination Heart (CERT/CC) stated in an advisory.
Provided that the software program is now not supported and is rooted in IoT-centric code, CERT/CC has warned that the vulnerability is “prone to floor in lots of locations within the wild.”
The problem impacts ASF 3.52.0.2574 and all prior variations of the software program, with the company additionally noting that a number of forks of the tinydhcp software program are probably inclined to the flaw as effectively.
There are presently no fixes or mitigations to handle CVE-2024-7490, barring changing the tinydhcp service with one other one that doesn’t have the identical problem.
The event comes as SonicWall Seize Labs detailed a extreme zero-click vulnerability affecting MediaTek Wi-Fi chipsets (CVE-2024-20017, CVSS 9.8) that would open the door to distant code execution with out requiring any consumer interplay attributable to an out-of-bounds write problem.
“The affected variations embody MediaTek SDK variations 7.4.0.1 and earlier, in addition to OpenWrt 19.07 and 21.02,” the corporate stated. “This interprets to a big number of weak units, together with routers and smartphones.”
“The vulnerability is a buffer overflow because of a size worth taken immediately from attacker-controlled packet knowledge with out bounds checking and positioned right into a reminiscence copy. This buffer overflow creates an out-of-bounds write.”
A patch for the vulnerability was launched by MediaTek in March 2024, though the chance of exploitation has elevated with the general public availability of a proof-of-concept (PoC) exploit as of August 30, 2024.
