CVE-2024-42446

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

APTIOV contains a vulnerability in BIOS where an attacker may cause a Time-of-check Time-of-use (TOCTOU) Race Condition by local means. Successful exploitation of this vulnerability may lead to arbitrary code execution.

Metrics

CVSS 3.1 7.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-367

Affected software

No affected versions have been published.

Timeline

Published: May 13, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424479.8Insufficient Session Expiration vulnerability in Apache Airflow Providers FAB. This issue affects Apache Airflow Providers FAB: 1.2.1 (when CVE-2024-424489.9From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to perform Rem CVE-2024-424497.1From the VSPC management agent machine, under condition that the management agent is authorized on the server, it is possible to remove arbi CVE-2024-42458.8A vulnerability, which was classified as critical, has been found in Tenda i21 1.0.0.14(4656). Affected by this issue is the function formQo CVE-2024-4245010.0The Versa Director uses PostgreSQL (Postgres) to store operational and configuration data. It is also needed for High Availability function CVE-2024-424516.5A vulnerability in Veeam Backup & Replication allows low-privileged users to leak all saved credentials in plaintext. This is achieved by ca CVE-2024-424528.8A vulnerability in Veeam Backup & Replication allows a low-privileged user to start an agent remotely in server mode and obtain credentials,CVE-2024-424538.1A vulnerability Veeam Backup & Replication allows low-privileged users to control and modify configurations on connected virtual infrastruct CVE-2024-424558.1A vulnerability in Veeam Backup & Replication allows a low-privileged user to connect to remoting services and exploit insecure deserializat CVE-2024-424568.8A vulnerability in Veeam Backup & Replication platform allows a low-privileged user with a specific role to exploit a method that updates cr CVE-2024-424576.5A vulnerability in Veeam Backup & Replication allows users with certain operator roles to expose saved credentials by leveraging a combinati CVE-2024-424589.8server.c in Neat VNC (aka neatvnc) before 0.8.1 does not properly validate the security type, a related issue to CVE-2006-2369.