« Volver al listado

CVE-2024-42642

Estado: ModificadaMedia (6.7)—

Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Crucial — Mx500 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-42642",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-42642",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-05T14:42:38.297045Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      },
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.7,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-09-04T20:15:07.007",
  "references": [
    {
      "url": "https://github.com/VL4DR/CVE-2024-42642/tree/main",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.crucial.com/support/ssd-support/mx500-support",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-120"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page."
    },
    {
      "lang": "es",
      "value": "Las unidades de estado sólido Micron Crucial serie MX500 M3CR046 son vulnerables a desbordamiento de búfer, que puede ser activado al enviar paquetes ATA especialmente diseñados desde el host al controlador de la unidad. NOTA: El proveedor afirma que esta vulnerabilidad fue completamente subsanada en diciembre de 2024 y que el firmware actualizado está disponible a través de la página de soporte oficial de Crucial."
    }
  ],
  "lastModified": "2026-07-05T02:16:47.490",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:crucial:mx500_firmware:m3cr046:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "294AB13C-B72A-4A2A-9479-0679E8F14CBE"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:crucial:ct1000mx500ssd1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9B1C100C-AEBD-4F78-B44B-964596EF0BEB"
            },
            {
              "criteria": "cpe:2.3:h:crucial:ct2000mx500ssd1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "53994271-93E3-4F6A-A518-508A7AF1DE2E"
            },
            {
              "criteria": "cpe:2.3:h:crucial:ct250mx500ssd1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8086BDF7-E0E1-4AC9-8944-F3882ABB529C"
            },
            {
              "criteria": "cpe:2.3:h:crucial:ct4000mx500ssd1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "C762652B-FB0E-4268-9C1F-2540298A4C21"
            },
            {
              "criteria": "cpe:2.3:h:crucial:ct500mx500ssd1:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A300BCAD-C58A-499B-A82D-5D7D484672E0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}