CVE-2024-42442

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

APTIOV contains a vulnerability in the BIOS where a user or attacker may cause an improper restriction of operations within the bounds of a memory buffer over the network. A successful exploitation of this vulnerability may lead to code execution outside of the intended System Management Mode.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
AMI	AptioV	>= BKS_5.0, <= BKS_5.37
ami	aptio_v	>= BKS_5.0, <= BKS_5.37

References

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/2024/AMI-SA-2024004.pdfVendor Advisory

Timeline

Published: Nov 12, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424447.8APTIOV contains a vulnerability in BIOS where an attacker may cause a TOCTOU Race Condition by local means. Successful exploitation of this CVE-2024-424467.0APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Succ CVE-2024-424479.8Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when CVE-2024-424489.9From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Rem CVE-2024-424497.1From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbi CVE-2024-42458.8A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQo CVE-2024-4245010.0The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function CVE-2024-424516.5A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by ca CVE-2024-424528.8A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials,CVE-2024-424538.1A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastruct CVE-2024-424558.1A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializat CVE-2024-424568.8A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates cr