CVE-2024-7544

Summary

CVE-2024-7544 is a heap-based buffer overflow vulnerability affecting oFono's SimToolKit. This issue enables local attackers to execute arbitrary code on impacted modems, given that they have already gained the ability to run code. The root cause of this flaw lies in the inadequate validation of user-supplied data lengths prior to copying it to a heap-buffer during the parsing of STK command PDUs. This vulnerability (ZDI-CAN-23457) allows attackers to escalate privileges to the service account, posing a significant risk to affected installations.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.