CVE-2024-56190

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Sep 4, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-561918.4In dhd_process_full_gscan_result of dhd_pno.c, there is a possible EoP due to an integer overflow. This could lead to local escalation of prCVE-2024-561927.8In wl_notify_gscan_event of wl_cfgscan.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local esCVE-2024-561935.1There is a possible disclosure of Bluetooth adapter details due to a permissions bypass. This could lead to local information disclosure witCVE-2024-561956.3Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.2.0 through 9.2.8, from 10CVE-2024-561966.3Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 10.0.0 through 10.0.3. UserCVE-2024-561974.9Discourse is an open source platform for community discussion. PM titles and metadata can be read by other users when the "PM tags allowed fCVE-2024-561989.3path-sanitizer is a simple lightweight npm package for sanitizing paths to prevent Path Traversal. Prior to 3.1.0, the filters can be bypassCVE-2024-561997.6phpMyFAQ is an open source FAQ web application. Starting no later than version 3.2.10 and prior to version 4.0.2, an attacker can inject malCVE-2024-56206.5Authentication Bypass Using an Alternate Path or Channel vulnerability in PruvaSoft Informatics Apinizer Management Console allows AuthenticCVE-2024-562008.6Altair is a fork of Misskey v12. Affected versions lack of request validation and lack of authentication in the image proxy for compressing CVE-2024-562018.8Jinja is an extensible templating engine. In versions on the 3.x branch prior to 3.1.5, a bug in the Jinja compiler allows an attacker that CVE-2024-562024.3Expected Behavior Violation vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.2.8, fro