CVE-2024-40659

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In getRegistration of RemoteProvisioningService.java, there is a possible way to permanently disable the AndroidKeyStore key generation feature by updating the attestation keys of all installed apps due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-120

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-40668.8A vulnerability classified as critical has been found in Tenda AC8 16.03.34.09. Affected is the function fromAdvSetMacMtuWan of the file /go CVE-2024-406607.8In setTransactionState of SurfaceFlinger.cpp, there is a possible way to change protected display attributes due to a logic error in the cod CVE-2024-406617.8In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permis CVE-2024-406627.8In scheme of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to local es CVE-2024-406646.2In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logi CVE-2024-406698.4In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addition CVE-2024-40675.3The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micr CVE-2024-406708.4In TBD of TBD, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no addition CVE-2024-406717.8In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission che CVE-2024-406728.4In onCreate of ChooserActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This cou CVE-2024-406736.5In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to imp CVE-2024-406745.3In validateSsid of WifiConfigurationUtil.java, there is a possible way to overflow a system configuration file due to a logic error in the c