Asrmicro ASR3607 Firmware vulnerabilities

5 CVEs affecting Asrmicro ASR3607 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-32634, published 2024-04-16.

More from Asrmicro.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-32625, published 2024-04-16. Medium severity, CVSS 5.8. EPSS: 0.4% chance of exploitation in the next 30 days. In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations
• CVE-2024-32631, published 2024-04-16. High severity, CVSS 8.0. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.
• CVE-2024-32634, published 2024-04-16. Medium severity, CVSS 6.1. EPSS: 0.3% chance of exploitation in the next 30 days. In huge memory get unmapped area check, code can never be reached because of a logical contradiction.
• CVE-2024-32633, published 2024-04-16. Medium severity, CVSS 4.0. EPSS: 0.2% chance of exploitation in the next 30 days. An unsigned value can never be negative, so eMMC full disk test will always evaluate the same way.
• CVE-2024-32632, published 2024-04-16. Medium severity, CVSS 6.6. EPSS: 0.2% chance of exploitation in the next 30 days. A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access