CVE-2024-39707

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Insyde IHISI function 0x49 can restore factory defaults for certain UEFI variables without further authentication by default, which could lead to a possible roll-back attack in certain platforms. This is fixed in: kernel 5.2, version 05.29.19; kernel 5.3, version 05.38.19; kernel 5.4, version 05.46.19; kernel 5.5, version 05.54.19; kernel 5.6, version 05.61.19.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published: Nov 14, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-397087.0An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. Sometim CVE-2024-397097.8Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version CVE-2024-39714.3The Similarity WordPress plugin through 3.0 does not have CSRF check in place when resetting its settings, which could allow attackers to ma CVE-2024-397109.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r CVE-2024-397119.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a CVE-2024-397129.1Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a r CVE-2024-397138.6A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.CVE-2024-397149.9A code injection vulnerability that permits a low-privileged user to upload arbitrary files to the server, leading to remote code execution CVE-2024-397158.5A code injection vulnerability that allows a low-privileged user with REST API access granted to remotely upload arbitrary files to the VSPC CVE-2024-397177.2The Versa Director GUI provides an option to customize the look and feel of the user interface. This option is only available for a user log CVE-2024-397188.1An improper input validation vulnerability that allows a low-privileged user to remotely remove files on the system with permissions equival CVE-2024-397197.5An issue was discovered in Ollama through 0.3.14. File existence disclosure can occur via api/create. When calling the CreateModel route wit