Description:

CVE-2024-29997 is a remote code execution vulnerability in the Windows Mobile Broadband Driver. It allows an attacker to execute arbitrary code on a vulnerable system with system privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity. However, SOCRadar's SVRS assigns it a score of 30, indicating a low risk. This discrepancy is due to the fact that the SVRS takes into account additional factors, such as social media chatter and dark web activity, which suggest that the vulnerability is not actively being exploited.

Key Insights:

• The vulnerability is in the wild, meaning that it is actively being exploited by hackers.
• The vulnerability affects all versions of Windows 10 and Windows 11.
• The vulnerability can be exploited remotely, without requiring any user interaction.
• The vulnerability can be used to execute arbitrary code on a vulnerable system with system privileges.

Mitigation Strategies:

• Apply the latest security updates from Microsoft.
• Disable the Mobile Broadband Driver if it is not needed.
• Use a firewall to block unauthorized access to the vulnerable system.
• Implement intrusion detection and prevention systems to detect and block attacks.

Additional Information:

• The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
• There are active exploits for the vulnerability that are publicly available.
• If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.