How severe is CVE-2024-32625?

CVE-2024-32625 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-32625 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-32625?

CVE-2024-32625 primarily affects Asrmicro Asr1806 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2024-32625?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-32625 have an EU (EUVD) identifier?

Yes. CVE-2024-32625 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-30427.

When was CVE-2024-32625 published?

CVE-2024-32625 was published on 2024-04-16 and last updated on 2026-06-17.

CVE-2024-32625

CVE-2024-32625 is a medium-severity vulnerability in Asrmicro Asr1806 Firmware with a CVSS 3.x base score of 5.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-457.

Key facts

Severity: Medium (CVSS 3.x base score 5.8)
EPSS exploit prediction: 0% (34th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-30427
Weakness: CWE-457
Affected product: Asrmicro Asr1806 Firmware
Published: 2024-04-16
Last modified: 2026-06-17

Description

In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations

Frequently asked questions

What is CVE-2024-32625?: In OffloadAMRWriter, a scalar field is not initialized so will contain an arbitrary value left over from earlier computations
How severe is CVE-2024-32625?: CVE-2024-32625 has a CVSS 3.x base score of 5.8, rated medium severity. It is exploitable over network with high attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-32625 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (34th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-32625?: CVE-2024-32625 primarily affects Asrmicro Asr1806 Firmware. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2024-32625?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-32625 have an EU (EUVD) identifier?: Yes. CVE-2024-32625 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-30427.
When was CVE-2024-32625 published?: CVE-2024-32625 was published on 2024-04-16 and last updated on 2026-06-17.

References

https://www.asrmicro.com/en/goods/psirt?cid=38

Affected products (13)

cpe:2.3:o:asrmicro:asr1806_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1803_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1606_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1603_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1602_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1605_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1609_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr3607_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr3605_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr3602_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1803sc_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr1607_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:asrmicro:asr3603_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Asrmicro Asr1806 Firmware

CVE-2024-32631 — High (CVSS 7.2): Out-of-Bounds read in ciCCIOTOPT in ASR180X will cause incorrect computations.
CVE-2023-49701 — High (CVSS 7.2): Memory Corruption in SIM management while USIMPhase2init
CVE-2023-49700 — Medium (CVSS 6.7): Security best practices violations, a string operation in Streamingmedia will write past the end of fixed-size…
CVE-2023-49699 — Medium (CVSS 6.7): Memory Corruption in IMS while calling VoLTE Streamingmedia Interface
CVE-2024-32632 — Medium (CVSS 6.6): A value in ATCMD will be misinterpreted by printf, causing incorrect output and possibly out-of-bounds memory access
CVE-2024-32634 — Medium (CVSS 6.1): In huge memory get unmapped area check, code can never be reached because of a logical contradiction.

All CVEs affecting Asrmicro Asr1806 Firmware →

Other CWE-457 vulnerabilities

CVE-2026-6748 — Critical (CVSS 9.8): Uninitialized memory in the Audio/Video: Web Codecs component. This vulnerability was fixed in Firefox 150, Firefox ESR…
CVE-2025-54874 — Critical (CVSS 9.8): OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may…
CVE-2025-53644 — Critical (CVSS 9.8): OpenCV is an Open Source Computer Vision Library. Versions 4.10.0 and 4.11.0 have an uninitialized pointer variable on…
CVE-2026-14405 — Critical (CVSS 9.6): Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code…
CVE-2026-13825 — High (CVSS 8.8): Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap…
CVE-2025-5749 — High (CVSS 8.8): WOLFBOX Level 2 EV Charger BLE Encryption Keys Uninitialized Variable Authentication Bypass Vulnerability. This…

Browse all CWE-457 vulnerabilities →