CVE-2024-42483: ESP-NOW Replay Attacks Vulnerability
ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadcast or unicast, and regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate entries, there by creating an opportunity to re-inject previously captured packets. This vulnerability is fixed in 2.5.2.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42483?
CVE-2024-42483 is rated as a medium severity vulnerability due to its potential for replay attacks in the ESP-NOW component.
How do I fix CVE-2024-42483?
To fix CVE-2024-42483, update the ESP-NOW component to version 2.5.2 or later, where the vulnerability has been addressed.
What does CVE-2024-42483 affect?
CVE-2024-42483 affects the implementation of the ESP-NOW component used in various Espressif devices.
What type of attack can exploit CVE-2024-42483?
CVE-2024-42483 can be exploited through replay attacks, where malicious actors can resend captured messages.
When was CVE-2024-42483 disclosed?
CVE-2024-42483 was disclosed in 2024, highlighting a vulnerability in the ESP-NOW protocol's message handling.