What is the CVSS score of CVE-2024-53021?

CVE-2024-53021 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Sm7250p Firmware are affected by CVE-2024-53021?

CVE-2024-53021 is a high-severity information disclosure vulnerability affecting systems processing RTCP network packets, with potential exposure of sensitive data to network-based attackers.

How to fix or mitigate CVE-2024-53021?

Within 24 hours: Identify and inventory all systems running affected software and assess exposure to untrusted networks. Within 7 days: Implement network segmentation to restrict RTCP traffic to trusted sources only and deploy enhanced monitoring for abnormal RTCP packet patterns. Within 30 days: Establish regular vendor communication cadence for patch availability updates and evaluate alternative products if patches remain unavailable beyond 60 days.

Sm7250p Firmware CVE-2024-53021

EUVD-2024-54632 HIGH

Buffer Over-read (CWE-126)

2025-06-03 product-security@qualcomm.com

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54632

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 8.2

DescriptionCVE.org

Information disclosure may occur while processing goodbye RTCP packet from network.

AnalysisAI

CVE-2024-53021 is an information disclosure vulnerability in RTCP (Real-time Transport Control Protocol) packet processing that allows unauthenticated remote attackers to leak sensitive data through malicious goodbye (BYE) RTCP packets. The vulnerability affects multiple VoIP and real-time communication products processing RTCP traffic; attackers can extract confidential information across the network without authentication or user interaction, and may also cause limited availability impact. The high CVSS score of 8.2 reflects the severe confidentiality impact and network-based attack vector, though exploitation complexity is low.

Technical ContextAI

RTCP (Real-time Transport Control Protocol, RFC 3550) is a companion protocol to RTP used for control and feedback in multimedia streaming applications. The vulnerability exists in RTCP BYE (goodbye) packet processing logic, a fundamental control message that indicates a participant is leaving an RTP session. CWE-126 (Buffer Over-read) indicates the root cause involves reading beyond intended buffer boundaries during RTCP packet parsing, likely when handling malformed BYE packet payloads or option fields. This buffer over-read can expose adjacent memory containing session keys, authentication tokens, codec parameters, or other sensitive RTP/RTCP session data. The vulnerability chain involves: (1) receipt of network RTCP BYE packet, (2) insufficient bounds checking during deserialization, (3) out-of-bounds memory access leaking heap or stack data. Affected products typically include VoIP endpoints (SIP phones, softphones), media servers, RTC libraries, and unified communications platforms that implement RTCP per RFC 3550.

RemediationAI

Specific patch information was not provided in the input. Remediation steps follow standard vulnerability response: (1) Consult vendor security advisories linked to CVE-2024-53021 for affected product versions and patched releases, (2) Apply security patches immediately to production systems, prioritizing media servers and SIP endpoints, (3) If patches unavailable, implement network-level RTCP filtering/monitoring to detect malformed BYE packets using DPI (deep packet inspection) rules that validate RTCP packet structure per RFC 3550, (4) Disable RTCP BYE processing if operationally feasible, falling back to session timeout mechanisms, (5) Isolate RTP sessions to trusted networks with firewall rules restricting RTCP traffic to known peer ranges, (6) Monitor for exploit attempts: log RTCP parsing errors, malformed packet drops, and memory access violations. Escalate to vendor support for specific patch timelines and zero-day guidance if production instances cannot be patched immediately.