CVE-2024-21938

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Incorrect default permissions in the AMD Management Plugin for the Microsoft® System Center Configuration Manager (SCCM) installation directory could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
AMD	AMD Management Plug-In for SCCM	< 7.0.0.1318
amd	management_plugin_for_sccm	< 7.0.0.1318

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-9005.htmlVendor Advisory

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-219397.3Incorrect default permissions in the AMD Cloud Manageability Service (ACMS) Software installation directory could allow an attacker to achie CVE-2024-21947.2The WP Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL search parameter in all versions up to, and CVE-2024-219445.3Improper input validation for DIMM serial presence detect (SPD) metadata could allow an attacker with physical access, ring0 access on a sys CVE-2024-219457.3Incorrect default permissions in the AMD RyzenTM Master monitoring SDK installation directory could allow an attacker to achieve privilege e CVE-2024-219467.3Incorrect default permissions in the AMD RyzenTM Master Utility installation directory could allow an attacker to achieve privilege escalati CVE-2024-219477.5Improper input validation in the system management mode (SMM) could allow a privileged attacker to overwrite arbitrary memory potentially re CVE-2024-219495.5Improper validation of user input in the NPU driver could allow an attacker to provide a buffer with unexpected size, potentially leading to CVE-2024-21959.8A critical Remote Code Execution (RCE) vulnerability was identified in the aimhubio/aim project, specifically within the `/api/runs/search/r CVE-2024-219501.8An out of bounds read in the remote management firmware could allow a privileged attacker read a limited section of memory outside of establ CVE-2024-219535.9Improper input validation in IOMMU could allow a malicious hypervisor to reconfigure IOMMU registers resulting in loss of guest data integri CVE-2024-219547.0Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support Address Translation Ca CVE-2024-219577.3Incorrect default permissions in the AMD Management Console installation directory could allow an attacker to achieve privilege escalation p