PT-2025-9109 · Minut · Minut M2

Troed Sã¥Ngberg · Published 2025-02-28 · Updated 2025-02-28 · CVE-2024-44754

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Minut M2 version #15142

Description The issue allows physically proximate attackers to extract cryptographic keys from the internal flash of Minut M2 devices with the specified firmware version. This can be used to inject modified firmware into other Minut M2 products via USB.

Recommendations For Minut M2 version #15142, consider restricting physical access to the device and avoiding the use of USB connections from untrusted sources until a fix is available. As a temporary workaround, restrict access to the device's internal flash to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2024-44754

Affected Products

Minut M2

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-44754 · Security Note
• https://twitter.com/CVEnew/status/1895619355972677867 · Twitter Post
• http://minut.com · Note
• https://amlisoft.se/sec_20241114.html · Note
• https://t.me/cvedetector/19176 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1895526275189457048 · Twitter Post
• https://twitter.com/cybercronai/status/1895523249846464956 · Twitter Post