CVE-2024-43488

Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

CVSS 8.8 HIGHEPSS 1.1%CWE-306

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8.8EPSS 1.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

08 Oct 2024Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Affected products

Microsoft · Visual Studio Code

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43488