Skip to main content

Nimble CVE-2024-47249

MEDIUM
Improper Validation of Array Index (CWE-129)
2024-11-26 security@apache.org
Buffer Overflow Apache Nimble
5.0
CVSS 3.1 · Vendor: apache
Share

Severity by source

Vendor (apache) PRIMARY
5.0 MEDIUM
AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from Vendor (apache) · only source for this CVE.

CVSS VectorVendor: apache

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack Vector
Adjacent
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

1
CVE Published
Nov 26, 2024 - 12:15 cve.org
MEDIUM 5.0

DescriptionCVE.org

Improper Validation of Array Index vulnerability in Apache NimBLE.

Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low. This issue affects Apache NimBLE: through 1.7.0.

Users are recommended to upgrade to version 1.8.0, which fixes the issue.

AnalysisAI

Improper Validation of Array Index vulnerability in Apache NimBLE. Rated medium severity (CVSS 5.0), this vulnerability is no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-129. Improper Validation of Array Index vulnerability in Apache NimBLE. Lack of input validation for HCI events from controller could result in out-of-bound memory corruption and crash. This issue requires broken or bogus Bluetooth controller and thus severity is considered low.7.0. Users are recommended to upgrade to version 1.8.0, which fixes the issue. Affected products include: Apache Nimble. Version information: through 1.7.0..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Nimble

View all
CVE-2025-62235 HIGH
8.1 Jan 10

Authentication Bypass by Spoofing vulnerability in Apache NimBLE. Receiving specially crafted Security Request could lea
CVE-2025-53477 HIGH
7.5 Jan 10

NULL Pointer Dereference vulnerability in Apache Nimble. Missing validation of HCI connection complete or HCI command TX
CVE-2025-52435 HIGH
7.5 Jan 10

J2EE Misconfiguration: Data Transmission Without Encryption vulnerability in Apache NimBLE. Improper handling of Pause E
CVE-2024-51569 HIGH
7.5 Nov 26

Out-of-bounds Read vulnerability in Apache NimBLE. Rated high severity (CVSS 7.5), this vulnerability is remotely exploi
CVE-2024-24746 HIGH
7.5 Apr 06

Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache NimBLE. Rated high severity (CVSS 7.5), t
CVE-2024-47248 MEDIUM
6.3 Nov 26

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Apache NimBLE. Rated medium seve
CVE-2024-47250 MEDIUM
5.0 Nov 26

Out-of-bounds Read vulnerability in Apache NimBLE. Rated medium severity (CVSS 5.0), this vulnerability is no authentica

Same weakness CWE-129 – Improper Validation of Array Index

View all
CVE-2016-9053 CRITICAL POC
9.8
CVE-2020-27485 CRITICAL POC
9.9
CVE-2020-27483 CRITICAL POC
9.9
CVE-2024-24563 CRITICAL POC
9.8
CVE-2017-8797 HIGH
7.5
CVE-2018-11489 HIGH POC
8.8
CVE-2026-56770 HIGH POC
8.7
CVE-2017-7228 HIGH POC
8.2

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2017-11882 HIGH POC
7.8
CVE-2010-3333 HIGH POC
7.8

Share

CVE-2024-47249 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy