CVE-2024-29155: Denial of service on Microchip RN4870 devices

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-10-16 · updated 2026-06-17
Weakness: CWE-239

Description

On Microchip RN4870 devices, when more than one consecutive PairReqNoInputNoOutput request is received, the device becomes incapable of completing the pairing process. A third party can inject a second PairReqNoInputNoOutput request just after a real one, causing the pair request to be blocked.

Affected products

Microchip RN4870: before 1.44 — fixed in 1.44

How to fix

Upgrade to a fixed version: Microchip RN4870 1.44. Check the vendor advisory for mitigations.

References

https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/SoftwareLibraries/Firmware/RN4870-71-Firmware-1.44.zip
https://www.microchip.com/en-us/product/rn4870

Get alerted when CVE-2024-29155 or the next vulnerability affects your stack