How severe is CVE-2024-10604?

CVE-2024-10604 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2024-10604 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-10604?

CVE-2024-10604 affects Google Fuchsia. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-10604?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-10604 have an EU (EUVD) identifier?

Yes. CVE-2024-10604 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-32906.

When was CVE-2024-10604 published?

CVE-2024-10604 was published on 2025-01-30 and last updated on 2026-06-17.

CVE-2024-10604

CVE-2024-10604 is a medium-severity vulnerability in Google Fuchsia with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-330.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v4: 6.9
EPSS exploit prediction: 0% (13th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-32906
Weakness: CWE-330
Affected product: Google Fuchsia
Published: 2025-01-30
Last modified: 2026-06-17

Description

Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances

Frequently asked questions

What is CVE-2024-10604?: Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances
How severe is CVE-2024-10604?: CVE-2024-10604 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2024-10604 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (13th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-10604?: CVE-2024-10604 affects Google Fuchsia. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-10604?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-10604 have an EU (EUVD) identifier?: Yes. CVE-2024-10604 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-32906.
When was CVE-2024-10604 published?: CVE-2024-10604 was published on 2025-01-30 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:o:google:fuchsia:*:*:*:*:*:*:*:*

More vulnerabilities in Google Fuchsia

CVE-2021-22566 — Critical (CVSS 9.8): An incorrect setting of UXN bits within mmu_flags_to_s1_pte_attr lead to privileged executable pages being mapped as…
CVE-2022-0247 — High (CVSS 7.5): An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker…
CVE-2022-0882 — Medium (CVSS 5.3): A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required…
CVE-2021-22556 — Medium (CVSS 5.3): The Security Team discovered an integer overflow bug that allows an attacker with code execution to issue memory cache…

All CVEs affecting Google Fuchsia →

Other CWE-330 (Use of Insufficiently Random Values) vulnerabilities

CVE-2023-22601 — Critical (CVSS 10.0): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version…
CVE-2026-25072 — Critical (CVSS 9.8): XikeStor SKS8310-8X Network Switch firmware versions 1.04.B07 and prior contain a predictable session identifier…
CVE-2026-27755 — Critical (CVSS 9.8): SODOLA SL902-SWTGW124AS firmware versions through 200.1.20 contain a weak session identifier generation vulnerability…
CVE-2026-27637 — Critical (CVSS 9.8): FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.206,…
CVE-2025-64097 — Critical (CVSS 9.8): NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A…
CVE-2025-4607 — Critical (CVSS 9.8): The PSW Front-end Login & Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up…

Browse all CWE-330 (Use of Insufficiently Random Values) vulnerabilities →