How severe is CVE-2024-29980?

CVE-2024-29980 has a CVSS 3.x base score of 2.3, rated low severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.

Is CVE-2024-29980 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-29980?

CVE-2024-29980 affects Phoenixtech Securecore Technology. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-29980?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-29980 have an EU (EUVD) identifier?

Yes. CVE-2024-29980 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-26952.

When was CVE-2024-29980 published?

CVE-2024-29980 was published on 2025-01-14 and last updated on 2026-06-17.

CVE-2024-29980

CVE-2024-29980 is a low-severity vulnerability in Phoenixtech Securecore Technology with a CVSS 3.x base score of 2.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-754.

Key facts

Severity: Low (CVSS 3.x base score 2.3)
CVSS v4: 4.6
EPSS exploit prediction: 0% (4th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-26952
Weakness: CWE-754
Affected product: Phoenixtech Securecore Technology
Published: 2025-01-14
Last modified: 2026-06-17

Description

Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.

Frequently asked questions

What is CVE-2024-29980?: Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake, Phoenix SecureCore™ for Intel Coffee Lake, Phoenix SecureCore™ for Intel Comet Lake, Phoenix SecureCore™ for Intel Ice Lake allows Input Data Manipulation.This issue affects SecureCore™ for Intel Kaby Lake: before 4.0.1.1012; SecureCore™ for Intel Coffee Lake: before 4.1.0.568; SecureCore™ for Intel Comet Lake: before 4.2.1.292; SecureCore™ for Intel Ice Lake: before 4.2.0.334.
How severe is CVE-2024-29980?: CVE-2024-29980 has a CVSS 3.x base score of 2.3, rated low severity. It is exploitable over local access with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability low.
Is CVE-2024-29980 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (4th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-29980?: CVE-2024-29980 affects Phoenixtech Securecore Technology. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-29980?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-29980 have an EU (EUVD) identifier?: Yes. CVE-2024-29980 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-26952.
When was CVE-2024-29980 published?: CVE-2024-29980 was published on 2025-01-14 and last updated on 2026-06-17.

References

https://phoenixtech.com/phoenix-security-notifications/cve-2024-29980/

Affected products (1)

cpe:2.3:o:phoenixtech:securecore_technology:*:*:*:*:*:*:*:*

More vulnerabilities in Phoenixtech Securecore Technology

CVE-2023-31100 — High (CVSS 8.4): Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash…
CVE-2023-5058 — High (CVSS 7.8): Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™…
CVE-2024-1598 — High (CVSS 7.5): Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for Intel Gemini Lake.This issue…
CVE-2024-0762 — High (CVSS 7.5): Potential buffer overflow in unsafe UEFI variable handling in Phoenix SecureCore™ for select Intel…
CVE-2024-12533 — Low (CVSS 3.3): Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore Technology 4 allows Input Data…
CVE-2024-29979 — Low (CVSS 2.3): Improper Check for Unusual or Exceptional Conditions vulnerability in Phoenix SecureCore™ for Intel Kaby Lake,…

All CVEs affecting Phoenixtech Securecore Technology →

Other CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities

CVE-2026-24054 — Critical (CVSS 10.0): Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs)…
CVE-2021-0211 — Critical (CVSS 10.0): An improper check for unusual or exceptional conditions in Juniper Networks Junos OS and Junos OS Evolved Routing…
CVE-2026-8091 — Critical (CVSS 9.8): Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150,…
CVE-2024-52316 — Critical (CVSS 9.8): Unchecked Error Condition vulnerability in Apache Tomcat. If Tomcat is configured to use a custom Jakarta…
CVE-2024-7826 — Critical (CVSS 9.8): Improper Check for Unusual or Exceptional Conditions vulnerability in Webroot SecureAnywhere - Web Shield on Windows,…
CVE-2023-37303 — Critical (CVSS 9.8): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to…

Browse all CWE-754 (Improper Check for Unusual or Exceptional Conditions) vulnerabilities →