VulnerabilityDeferred

CVE-2024-29155

A third party can inject a second PairReqNoInputNoOutput request just after a real one, causing the pair request to be blocked.

MEDIUM 4.3EPSS 0.23%

Does this matter?

Lower severity and a low EPSS score (0.23%). Track it; it rarely justifies an emergency change on its own.

Description

On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, causing the pair request to be blocked.

CVSS 3.1: 4.3 MEDIUMCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS: 0.23% probability · 14th percentile
CISA KEV: Not listed
Weakness: CWE-239
Source: dc3f6da9-85b5-4a73-84a2-2ec90b40fca5

References

https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/SoftwareLibraries/Firmware/RN4870-71-Firmware-1.44.zip
https://www.microchip.com/en-us/product/rn4870

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.