Arbitrary I/O to Firmware via IOCTL with Insufficient Access Control
CVE-2024-29216

Currently unrated

Key Information:

Vendor: Sangoma Technologies
Status: Cg6kwin2k.sys
Vendor: CVE Published:; 25 March 2024

🔔 Create Sangoma Technologies Vulnerability Alert

What is CVE-2024-29216?

Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administrator privilege may perform I/O to arbitrary hardware port or physical address, resulting in erasing or altering the firmware.

Affected Version(s)

cg6kwin2k.sys prior to 2.1.7.0

References

https://sangomakb.atlassian.net/wiki/spaces/DVC/pages/453...

https://jvn.jp/en/vu/JVNVU90671953/

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Mar 25, 2024
Vulnerability Reserved
Mar 19, 2024

CVE-2024-29216 Data

JSON