« Volver al listado

CVE-2024-29155

Estado: AplazadaMedia (4.3)—

On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, causing the pair request to be blocked.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Microchip — Rn4870AI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-29155",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-29155",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-16T17:13:24.313288Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.3,
          "attackVector": "ADJACENT_NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
      "affectedData": [
        {
          "vendor": "Microchip",
          "product": "RN4870",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.44",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-16T16:15:03.630",
  "references": [
    {
      "url": "https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/SoftwareLibraries/Firmware/RN4870-71-Firmware-1.44.zip",
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"
    },
    {
      "url": "https://www.microchip.com/en-us/product/rn4870",
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5",
      "description": [
        {
          "lang": "en",
          "value": "CWE-239"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is \nreceived, the device becomes incapable of completing the pairing \nprocess. A third party can inject a second PairReqNoInputNoOutput request \njust after a real one, causing the pair request to be blocked."
    },
    {
      "lang": "es",
      "value": "En los dispositivos Microchip RN4870, cuando se recibe más de una solicitud PairReqNoInputNoOutput consecutiva, el dispositivo no puede completar el proceso de emparejamiento. Un tercero puede inyectar una segunda solicitud PairReqNoInputNoOutput justo después de una real, lo que hace que la solicitud de emparejamiento se bloquee."
    }
  ],
  "lastModified": "2026-06-17T07:22:30.963",
  "sourceIdentifier": "dc3f6da9-85b5-4a73-84a2-2ec90b40fca5"
}