What’s Vulnerable › Vulnerabilities

CVE-2024-29216

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-03-25 · updated 2026-06-17
• Weakness: CWE-522

Description

Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0. By sending a specific IOCTL request, a user without the administrator privilege may perform I/O to arbitrary hardware port or physical address, resulting in erasing or altering the firmware.

Affected products

• Sangoma Technologies cg6kwin2k.sys: before 2.1.7.0

References

• https://jvn.jp/en/vu/JVNVU90671953/
• https://sangomakb.atlassian.net/wiki/spaces/DVC/pages/45351279/Natural+Access+Software+Download
• https://jvn.jp/en/vu/JVNVU90671953/
• https://sangomakb.atlassian.net/wiki/spaces/DVC/pages/45351279/Natural+Access+Software+Download

Get alerted when CVE-2024-29216 or the next vulnerability affects your stack