PT-2024-19106 · Unknown · Hacker Hotel Badge 2024

Casper Kuijpers + 3 · Published 2024-02-11 · Updated 2024-10-16 · CVE-2024-21875

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hacker Hotel Badge 2024 versions 0.1.0 through 0.1.3

Description The issue is related to an Allocation of Resources Without Limits or Throttling vulnerability in the Badge, leading to a denial of service attack. This vulnerability allows flooding on the Hacker Hotel Badge 2024, specifically on risc-v billboard modules.

Recommendations For versions 0.1.0 through 0.1.3, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the billboard modules to minimize the risk of exploitation. Avoid using the vulnerable badge until the issue is resolved.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-770

Related Identifiers

CVE-2024-21875

Affected Products

Hacker Hotel Badge 2024

References · 11

• 🔥 https://github.com/badgeteam/hackerhotel-2024-firmware-esp32c6/pull/64 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-21875 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21875 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1756643370577830079 · Twitter Post
• https://t.me/cvenotify/76523 · Telegram Post
• https://twitter.com/SchizoDuckie/status/1757048914744627212 · Twitter Post
• https://t.me/cvenotify/93335 · Telegram Post
• https://twitter.com/SchizoDuckie/status/1756618011820126248 · Twitter Post
• https://csirt.divd.nl/CVE-2024-21875 · Note
• https://t.me/cvenotify/70985 · Telegram Post
• https://twitter.com/CVEnew/status/1756602116980789430 · Twitter Post