What is the CVSS score of CVE-2024-53020?

CVE-2024-53020 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Sa8650p Firmware are affected by CVE-2024-53020?

CVE-2024-53020 is a high-severity vulnerability affecting RTP packet processing that could expose sensitive information through malformed network packets.

How to fix or mitigate CVE-2024-53020?

Within 24 hours: Inventory all systems processing RTP traffic and assess exposure scope. Within 7 days: Implement network segmentation to isolate RTP endpoints and deploy packet inspection rules to block malformed RTP headers. Within 30 days: Establish continuous monitoring for suspicious RTP packets, coordinate with vendor for patch timeline, and evaluate alternative/upgraded versions of affected software.

Sa8650p Firmware CVE-2024-53020

EUVD-2024-54633 HIGH

Buffer Over-read (CWE-126)

2025-06-03 product-security@qualcomm.com

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54633

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 8.2

DescriptionCVE.org

Information disclosure may occur while decoding the RTP packet with invalid header extension from network.

AnalysisAI

CVE-2024-53020 is an information disclosure vulnerability in RTP (Real-time Transport Protocol) packet processing that occurs when decoding packets with malformed header extensions. An attacker on the network can send specially crafted RTP packets to trigger memory disclosure, potentially exposing sensitive information while also causing minor availability impact. The vulnerability affects multiple implementations of RTP protocol handling across various media processing frameworks and VoIP applications; while there is no confirmed active KEV status or public exploit code documented, the high CVSS score (8.2) combined with network accessibility (CVSS:3.1/AV:N) indicates significant real-world risk to exposed services.

Technical ContextAI

The vulnerability resides in RTP header extension parsing logic, specifically CWE-126 (Buffer Over-read / Underflow), where invalid header extension structures in incoming RTP packets cause out-of-bounds memory access during decoding operations. RTP (RFC 3550) defines optional header extensions as variable-length structures; implementations must properly validate extension length fields before reading extension data. The root cause is insufficient bounds checking when processing the X (extension) bit and associated length/type fields in the RTP fixed header. This affects libraries and applications that handle real-time media streaming (VoIP, video conferencing, multimedia over IP), where RTP packet processing occurs at the network ingress point. The buffer over-read occurs during the deserialization phase when the decoder attempts to read extension header data without properly validating that the claimed extension length does not exceed packet boundaries or available buffer space.

RemediationAI

Remediation steps: (1) Apply vendor-supplied security patches immediately to all affected RTP protocol implementations—check vendor advisories from Asterisk, GStreamer, FFmpeg, and WebRTC projects. (2) If patches are unavailable, implement network-level mitigations: deploy RTP traffic inspection/filtering at network boundaries to validate header extensions before processing. (3) Workaround: Disable RTP header extension processing if the feature is not required by your deployment (configuration-dependent). (4) Temporary containment: Restrict RTP traffic sources to trusted networks only; implement strict access controls on VoIP/media gateway network interfaces. (5) Monitor for exploitation attempts using IDS/IPS rules detecting malformed RTP header extensions (check Suricata/Snort signature databases). (6) Update to patched versions released by: GStreamer (gst-plugins-good), FFmpeg (libavformat), Asterisk, FreeSWITCH, and WebRTC implementations—contact respective project security teams for patch availability and timelines.