Vulnerability · Published Aug 8, 2024 · Assigned by Microchip

CVE-2024-7490Remote Code Execution in Advanced Software Framework DHCP server

Critical 9.5

In plain English

A critical-severity buffer overflow in Advanced Software Framework from Microchip Techology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities).

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)1.4%top 27.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper Input Validation vulnerability in Microchip Techology Advanced Software Framework example DHCP server can cause remote code execution through a buffer overflow. This vulnerability is associated with program files tinydhcpserver.C and program routines lwip_dhcp_find_option. This issue affects Advanced Software Framework: through 3.52.0.2574. ASF is no longer being supported. Apply provided workaround or migrate to an actively maintained framework.

Affected products (as reported)

Vendor	Product	Versions
Microchip Techology	Advanced Software Framework	0 – through 3.52.0.2574

Weakness: CWE-120 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

In plain English

Official description

Affected products (as reported)

References