Multiple vulnerabilities in Intel PROSet/Wireless Wi-Fi Software and Intel Wireless Bluetooth
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 4 |
| CVE-ID | CVE-2024-23198 CVE-2024-28049 CVE-2024-24984 CVE-2024-25563 |
| CWE-ID | CWE-20 CWE-665 |
| Exploitation vector | Local network |
| Public exploit | N/A |
| Vulnerable software |
Intel Killer Wi-Fi Hardware solutions / Firmware Intel Wireless Bluetooth Client/Desktop applications / Other client software Windows 10 Wi-Fi Drivers for Intel Wireless Adapters Hardware solutions / Drivers |
| Vendor | Intel |
Security Bulletin
This security bulletin contains information about 4 vulnerabilities.
1) Input validation error
EUVDB-ID: #VU101943
Risk: Medium
CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-23198
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can trick the victim into connecting to a malicious AP and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIntel Killer Wi-Fi: before 23.40.0
Intel Wireless Bluetooth: before 23.40.0
Windows 10 Wi-Fi Drivers for Intel Wireless Adapters: before 23.40.0
CPE2.3- cpe:2.3:h:intel:intel_killer_wi-fi:*:*:*:*:*:*:*:*
- cpe:2.3:a:intel:intel_wireless_bluetooth:*:*:*:*:*:*:*:*
- cpe:2.3:h:intel:windows_10_wi-fi_drivers_for_intel_wireless_adapters:*:*:*:*:*:*:*:*
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU101944
Risk: Medium
CVSSv4.0: 4.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-28049
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can trick the victim into connecting to a malicious AP and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIntel Killer Wi-Fi: before 23.40.0
Intel Wireless Bluetooth: before 23.40.0
Windows 10 Wi-Fi Drivers for Intel Wireless Adapters: before 23.40.0
CPE2.3- cpe:2.3:h:intel:intel_killer_wi-fi:*:*:*:*:*:*:*:*
- cpe:2.3:a:intel:intel_wireless_bluetooth:*:*:*:*:*:*:*:*
- cpe:2.3:h:intel:windows_10_wi-fi_drivers_for_intel_wireless_adapters:*:*:*:*:*:*:*:*
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Input validation error
EUVDB-ID: #VU101945
Risk: Medium
CVSSv4.0: 4.9 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2024-24984
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker send specially crafted packets to the system and perform a denial of service (DoS) attack.
MitigationInstall updates from vendor's website.
Vulnerable software versionsIntel Killer Wi-Fi: before 23.40.0
Intel Wireless Bluetooth: before 23.40.0
Windows 10 Wi-Fi Drivers for Intel Wireless Adapters: before 23.40.0
CPE2.3- cpe:2.3:h:intel:intel_killer_wi-fi:*:*:*:*:*:*:*:*
- cpe:2.3:a:intel:intel_wireless_bluetooth:*:*:*:*:*:*:*:*
- cpe:2.3:h:intel:windows_10_wi-fi_drivers_for_intel_wireless_adapters:*:*:*:*:*:*:*:*
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
4) Improper Initialization
EUVDB-ID: #VU101946
Risk: Low
CVSSv4.0: 1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2024-25563
CWE-ID:
CWE-665 - Improper Initialization
Exploit availability: No
DescriptionThe vulnerability allows a local user to gain access to sensitive information.
The vulnerability exists due to improper initialization. A local user can gain access to sensitive information on the system.
Install updates from vendor's website.
Vulnerable software versionsIntel Killer Wi-Fi: before 23.40.0
Intel Wireless Bluetooth: before 23.40.0
Windows 10 Wi-Fi Drivers for Intel Wireless Adapters: before 23.40.0
CPE2.3- cpe:2.3:h:intel:intel_killer_wi-fi:*:*:*:*:*:*:*:*
- cpe:2.3:a:intel:intel_wireless_bluetooth:*:*:*:*:*:*:*:*
- cpe:2.3:h:intel:windows_10_wi-fi_drivers_for_intel_wireless_adapters:*:*:*:*:*:*:*:*
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01108.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
