CVE-2024-23960
CVSS 3.1 Score 4.6 of 10 (medium)
Details
Published Sep 28, 2024
Updated: Oct 3, 2024
CWE ID 347
Summary
CVE-2024-23960 is a vulnerability affecting Alpine Halo9 devices. It enables physically present attackers to bypass signature validation, allowing them to execute arbitrary code in the context of root without requiring authentication. The root cause of this issue lies in the firmware metadata signature validation mechanism, which fails to properly verify cryptographic signatures. This defect was identified as ZDI-CAN-23102.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Vendors
- Alps Alpine