CVE-2024-7542
published 2024-08-06CVE-2024-7542: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information…
PriorityP415low3.3CVSS 3.1
AVLACLPRLUINSUCLINAN
EPSS
0.30%
21.6th percentile
oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | ofono | < ofono 2.14-1 (forky) | ofono 2.14-1 (forky) |
| ofono | ofono | — | — |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono | ofono | >= 0 < 2.14-1 | 2.14-1 |
| ofono_project | ofono | — | — |
CVSS provenance
nvdv3.13.3LOWCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
nvdv3.03.3LOWCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
osv3.3LOW
vendor_ubuntu7.8HIGH
vendor_debian3.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
oFono vulnerabilities
vendor_ubuntu·2026-04-16·CVSS 7.8
CVE-2024-7540 [HIGH] oFono vulnerabilities
Title: oFono vulnerabilities
Summary: oFono could be made to crash if it received specially crafted input.
It was discovered that oFono incorrectly handled crafted responses
from AT commands. An attacker could possibly use this issue to crash
the program, resulting in a denial of service or arbitrary code
execution. (CVE-2024-7538, CVE-2024-7539, CVE-2024-7540, CVE-2024-7541,
CVE-2024-7542)
Lucas Leong discovered that oFono incorrectly handled crafted input.
An attacker could possibly use this issue to crash the program,
resulting in a denial of service or arbitrary code execution.
(CVE-2024-7543, CVE-2024-7544, CVE-2024-7545, CVE-2024-7546,
CVE-2024-7547)
Instructions: In general, a standard system update will make all the necessary changes.
Debian
CVE-2024-7542: ofono - oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerabilit...
vendor_debian·2024·CVSS 3.3
CVE-2024-7542 [LOW] CVE-2024-7542: ofono - oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerabilit...
oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309.
Scope: local
bookworm: open
bullseye: open
forky: resolved (fixed in 2.14-1)
sid: resolved (fixed in 2.14-1)
trixie: resolved (fixed in 2.14-1)
VulDB
oFono 1.34 AT CMGR Command uninitialized variable (ZDI-24-1082 / Nessus ID 307010)
vuldb·2026-04-17·CVSS 3.3
CVE-2024-7542 [LOW] oFono 1.34 AT CMGR Command uninitialized variable (ZDI-24-1082 / Nessus ID 307010)
A vulnerability was found in oFono 1.34. It has been rated as problematic. The impacted element is an unknown function of the component AT CMGR Command Handler. The manipulation leads to use of uninitialized variable.
This vulnerability is referenced as CVE-2024-7542. The attack can only be performed from a local environment. No exploit is available.
GHSA
GHSA-5v2c-phpf-wrv5: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability
ghsa_unreviewed·2024-08-06
CVE-2024-7542 [LOW] CWE-457 GHSA-5v2c-phpf-wrv5: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability
oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability.
The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309.
OSV
CVE-2024-7542: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability
osv·2024-08-06·CVSS 3.3
CVE-2024-7542 [LOW] CVE-2024-7542: oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability
oFono AT CMGR Command Uninitialized Variable Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of oFono. An attacker must first obtain the ability to execute code on the target modem in order to exploit this vulnerability. The specific flaw exists within the parsing of responses from AT+CMGR commands. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of root. Was ZDI-CAN-23309.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-08-06
Published