Main Vulnerability Database Vulnerabilities #VU91700

Input validation error in Microsoft Windows and Windows Server - CVE-2024-30078

Published: June 11, 2024 / Updated: November 4, 2024

Vulnerability identifier: #VU91700

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-30078

CWE-ID: CWE-20

Exploitation vector: Adjecent network

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insufficient validation of user-supplied input in Windows Wi-Fi Driver. A remote attacker on the local network can pass specially crafted input to the application and execute arbitrary code on the system.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2024-30078

Install updates from vendor's website.

Microsoft Windows - addressed in versions 10 21H2 10.0.19043.4529, 10 1507 10.0.10240.20680, 10 1607 10.0.14393.7070, 10 1809 10.0.17763.5936, 11 21H2 10.0.22000.3019, 11 22H2 10.0.22621.3737, 11 23H2 10.0.22631.3737
Windows Server - addressed in versions 2008 R2 6.1.7601.27170, 2008 6.0.6003.22720, 2012 R2 6.3.9600.22023, 2012 6.2.9200.24919, 2022 10.0.20348.2522, 2022 10.0.20348.2527

Links to Public Exploits and PoC-codes

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-30078

Related Security Bulletins

Remote code execution in Windows Wi-Fi Driver