CVE-2024-33660: Potential Firmware update without integrity check

Medium severity · published Nov 12, 2024

CVE-2024-33660

Potential Firmware update without integrity check

4.3

CVSS

0.2%

EPSS

On KEV

Description

An exploit is possible where an actor with physical access can manipulate SPI flash without being detected.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack vector

Physical

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 4% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AptioV · AMI

BKS_5.0 through BKS_5.37 · source: vendor

Aptio V · Ami

5.0 before 5.037 · source: NVD

Affected product

AptioV

AMI

All AptioV CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-33660

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-33660

Vendor Advisory

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024004.pdf