CVE-2024-42483

See a problem?
Please try reporting it to the source first.

Source

https://nvd.nist.gov/vuln/detail/CVE-2024-42483

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42483.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-42483

Aliases

GHSA-wf6q-c2xr-77xj

Published

2024-09-12T14:12:18.128Z

Modified

2025-12-05T05:58:01.562945Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

ESP-NOW Replay Attacks Vulnerability

Details

ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadcast or unicast, and regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate entries, there by creating an opportunity to re-inject previously captured packets. This vulnerability is fixed in 2.5.2.

Database specific

{
    "cwe_ids": [
        "CWE-349"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/42xxx/CVE-2024-42483.json"
}

References

Affected packages

Git / github.com/espressif/esp-now

Affected ranges

Type: GIT
Repo: https://github.com/espressif/esp-now
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

4e30db50d541b2909d278ef0db05de1a3d7190ef

Affected versions

v1.*

v1.0

v1.0-beta1

Database specific

vanir_signatures

[
    {
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "225879706808800885385744010271466717222",
                "191396395640810832262384205635545090959",
                "35056105069110545446243454434090749990",
                "92905295075898732244401483280138117250",
                "188974842305330857894367651871719673297",
                "291971526482730064922908497916765433578",
                "213737281713860798819308476783190448445",
                "200295245197991587868803655602321809956",
                "187221908248156438336966562041313504447",
                "191371304087907037437095406044471104926",
                "315178118724050405910700607672471550661",
                "295527762768338607139091063624116607565",
                "88027809489771668546542122393400537932",
                "277401858507381053071938801695645686524",
                "319537865317270865254647829418216780067",
                "93243745566323176146980204126404657931",
                "97221875287463018861554220707774243551"
            ]
        },
        "id": "CVE-2024-42483-07cfecd7",
        "source": "https://github.com/espressif/esp-now/commit/4e30db50d541b2909d278ef0db05de1a3d7190ef",
        "signature_type": "Line",
        "target": {
            "file": "src/espnow/src/espnow.c"
        },
        "signature_version": "v1",
        "deprecated": false
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-42483.json"