CVE-2024-22004 Unchecked length in Trusted Application on Google Nest Wifi Pro, leading to out of bounds read
An attacker with local privileges can trigger an out-of-bounds read to leak secure memory from the Trusted Application on Google Nest Wifi Pro devices.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-22004?
CVE-2024-22004 is a critical vulnerability in Google Nest Wifi Pro, published on 5 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Due to length check, an attacker with privilege access on a Linux Nonsecure operating system can trigger a vulnerability and leak the secure memory from the Trusted Application
Weakness: CWE-125
Which versions are affected by CVE-2024-22004?
It affects 3 products.
Products include Google Nest Wifi Point Firmware, Google Nest Wifi Pro Firmware, Google Nest Wifi Router Firmware.
How do I fix CVE-2024-22004?
No fix has been published for CVE-2024-22004 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-22004 being exploited?
There is no known exploitation of CVE-2024-22004 in the wild and no public exploit code.
Other vulnerabilities in Google Nest Wifi Pro
Sources
Also known as GHSA-54gx-9g28-h45h.