What is the CVSS score of EUVD-2024-54634?

EUVD-2024-54634 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L. EPSS exploitation probability: 0.1%.

Which versions of Wsa8840 Firmware are affected by EUVD-2024-54634?

CVE-2024-53019 is a high-severity vulnerability affecting RTP packet processing that could allow attackers to extract sensitive information from systems handling voice and video communications.

How to fix or mitigate EUVD-2024-54634?

Within 24 hours: Identify and inventory all systems processing RTP traffic; assess exposure in production environments and classify by criticality. Within 7 days: Implement network segmentation to isolate RTP streams; enable enhanced monitoring and logging for RTP packet anomalies; coordinate with vendors for patch timelines. Within 30 days: Deploy compensating controls; conduct security assessment of affected systems; establish patch deployment plan immediately upon vendor availability.

Wsa8840 Firmware EUVD-2024-54634

| CVE-2024-53019 HIGH

Buffer Over-read (CWE-126)

2025-06-03 product-security@qualcomm.com

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2024-54634

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 06:15 nvd

HIGH 8.2

DescriptionCVE.org

Information disclosure may occur while decoding the RTP packet with improper header length for number of contributing sources.

AnalysisAI

Network-based information disclosure vulnerability in RTP (Real-time Transport Protocol) packet decoding that occurs when the CSRC (Contributing Source) count header field is improperly validated, allowing an attacker to read sensitive memory contents. The vulnerability affects any system processing RTP streams with malformed headers and has a high CVSS score of 8.2 due to the combination of high confidentiality impact and network accessibility without authentication; no patch availability, KEV status, EPSS score, or active exploitation details are currently documented.

Technical ContextAI

RTP (RFC 3550) is a widely-used protocol for real-time media transport over IP networks. The vulnerability exists in the RTP header parsing logic, specifically in how the CC (CSRC count) field—which indicates the number of contributing sources in the CSRC list—is processed. CWE-126 (Buffer Over-read) indicates the root cause: improper validation of the CC header field length allows reading beyond allocated buffer boundaries, leaking adjacent heap/stack memory. This affects any RTP decoder/library that fails to validate that the declared CSRC count matches actual available packet data before dereferencing the header structure. Vulnerable implementations likely include libavformat (FFmpeg), GStreamer RTP plugins, PJSIP, Kurento, and other multimedia frameworks that parse RTP headers without bounds checking on the CC field.

RemediationAI

Remediation requires: (1) Immediate action: Identify all systems processing RTP streams (VoIP servers, conferencing platforms, media gateways, video surveillance systems); (2) Patch/Update: Apply vendor security updates to RTP libraries and applications as they become available—check FFmpeg, GStreamer, PJSIP, Asterisk, Kurento project pages for CVE-2024-53019 patches; (3) Temporary mitigation: Implement network-level filtering to reject malformed RTP packets with invalid CSRC counts (if detection logic is available); restrict RTP traffic to trusted sources only; (4) Workaround: If patching is delayed, disable RTP decoding features or use hardware appliances with updated firmware; (5) Validation: After patching, test RTP functionality end-to-end to ensure no regression. Monitor vendor advisories (NIST NVD, vendor security pages) for patch release timelines.