CVE-2024-43555 – This vulnerability in the Windows Mobile Broadb... (How to Fix)

Q: What is the severity of CVE-2024-43555?

CVE-2024-43555 has a CVSS score of 6.5 (MEDIUM). This vulnerability in the Windows Mobile Broadband Driver allows attackers to cause a denial of service (system crash/BSOD) by sending specially crafted requests. It affects Windows systems with mobile broadband hardware or drivers installed. Attackers need local access to exploit this vulnerability.

📋 TL;DR

This vulnerability in the Windows Mobile Broadband Driver allows attackers to cause a denial of service (system crash/BSOD) by sending specially crafted requests. It affects Windows systems with mobile broadband hardware or drivers installed. Attackers need local access to exploit this vulnerability.

💻 Affected Systems

Products:

Windows Mobile Broadband Driver

Versions: Specific Windows versions as listed in Microsoft advisory

Operating Systems: Windows 10, Windows 11, Windows Server 2022

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects systems with mobile broadband hardware/drivers installed. Systems without mobile broadband adapters are not vulnerable.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete system crash resulting in Blue Screen of Death (BSOD), requiring physical reboot and potential data loss from unsaved work.

🟠

Likely Case

Temporary denial of service affecting mobile broadband connectivity and potentially causing system instability until reboot.

🟢

If Mitigated

Minimal impact with proper access controls preventing unauthorized local access to affected systems.

🌐 Internet-Facing: LOW - Requires local system access, not directly exploitable over network.

🏢 Internal Only: MEDIUM - Insider threats or compromised accounts could exploit this to disrupt systems.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Requires local system access and knowledge of driver interaction. CWE-125 indicates out-of-bounds read vulnerability.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check Microsoft's monthly security updates for specific KB numbers

Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43555

Restart Required: Yes

Instructions:

1. Apply latest Windows security updates via Windows Update. 2. For enterprise: Deploy through WSUS or Microsoft Endpoint Configuration Manager. 3. Verify installation in Windows Update history.

🔧 Temporary Workarounds

Disable Mobile Broadband Interface

windows

Temporarily disable mobile broadband hardware if not needed

Device Manager > Network adapters > Right-click mobile broadband adapter > Disable device

🧯 If You Can't Patch

Restrict local access to systems with mobile broadband hardware
Implement application control policies to prevent unauthorized driver interactions

🔍 How to Verify

Check if Vulnerable:

Check if mobile broadband drivers are installed via Device Manager and verify Windows version against Microsoft advisory

Check Version:

winver

Verify Fix Applied:

Verify Windows Update history contains the relevant security update KB number

📡 Detection & Monitoring

Log Indicators:

System event logs showing unexpected driver crashes
BSOD crash dumps related to netwtwXX.sys or similar mobile broadband drivers

Network Indicators:

Unusual local system calls to mobile broadband driver interfaces

SIEM Query:

EventID=1001 OR EventID=41 AND Source="Microsoft-Windows-Kernel-Power" AND Description contains "netwtw"

📊 Metadata

CVE ID: CVE-2024-43555

CVSS v3 Score: 6.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-125

Published: October 8, 2024

Last Updated: October 17, 2024

🔗 References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43555 Patch,Vendor Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-43555, you might also want to check these: