by Kastro
Paper/Archive/CVE-2024-43488

CVE-2024-43488

Microsoft Visual Studio Code — Visual Studio Code extension for Arduino Remote Code Execution Vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.9.689 × 2013.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Missing authentication for critical function in Visual Studio Code extension for Arduino allows an unauthenticated attacker to perform remote code execution through network attack vector.

Affected

ProductAffectedFixed inSource
Visual Studio Code-–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
microsoft (CNA)8.8CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2024-43488