CVE-2024-28115

highpriority · track · 31EPSS 0.002 · 15 %ileDEEURUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

0.24% (15th) EPSS

CVSS 7.8 · high

Is it mine?

18 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-28

FreeRTOS is a real-time operating system for microcontrollers. FreeRTOS Kernel versions through 10.6.1 do not sufficiently protect against local privilege escalation via Return Oriented Programming techniques should a vulnerability exist that allows code injection and execution. These issues affect ARMv7-M MPU ports, and ARMv8-M ports with Memory Protected Unit (MPU) support enabled (i.e. `configENABLE_MPU` set to 1). These issues are fixed in version 10.6.2 with a new MPU wrapper.

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.8 · impact 5.9

v3.18.8highAV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:Hsecondary · security-advisories@github.comexploitability 2 · impact 6

v3.17.8highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · SICK PSIRT DE

v3.17.1highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-280USCWE-284USCWE-284US

affected products (18)

Products and version ranges known to be affected.

FreeRTOS FreeRTOS-Kernelall versionsenisa_euvdEU
FreeRTOS FreeRTOS-Kernel≤ < 10.6.2enisa_euvdEU
Amazon Web Services, Inc. FreeRTOS≤ 10.6.2fstec_bduRU
amazon freertos< 10.6.2nvdUScpe:2.3:o:amazon:freertos:*:*:*:*:*:*:*:*
SICK ANM58B all Firmware versionsall versionsnot affectedsick_psirtDE
SICK ANS58B all Firmware versionsall versionsnot affectedsick_psirtDE
SICK DCM4 with Firmware 1.2.0 up to 1.4.0all versionsnot affectedsick_psirtDE
SICK DMM4 with Firmware 1.2.0 up to 1.4.0all versionsnot affectedsick_psirtDE
SICK FXL1 with Firmware 1.6.0 up to 1.21.0all versionsnot affectedsick_psirtDE
SICK SE1 with Firmware 1.16.0 up to 1.17.0all versionsnot affectedsick_psirtDE
SICK deTec4 with Firmware 1.05 up to 1.51.0all versionsnot affectedsick_psirtDE
SICK deTem2 Core A/P with Firmware 1.04 up to 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 A/P with Firmware 1.02 up to 1.32.0all versionsnot affectedsick_psirtDE
SICK deTem4 Core A/P with Firmware 1.04 up to 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 LT Muting A/P with Firmware 1.10all versionsnot affectedsick_psirtDE
SICK deTem4 with Firmware 1.02 up to 1.3.0all versionsnot affectedsick_psirtDE
SICK safeVisionary2 all Firmware versionsall versionsnot affectedsick_psirtDE
SICK scanGrid2 with Firmware 1.10 up to 1.15all versionsnot affectedsick_psirtDE

advisories (1)

Vendor and ecosystem advisories describing this.

SCA-2025-0003FreeRTOS Vulnerabilities have no impact on SICK Products2025-02-28csaf · sick_psirtDE
FreeRTOS has several known vulnerabilities and is used in various SICK products. A current analysis confirms that the identified vulnerabilities in FreeRTOS do not affect the mentioned SICK products. At this time, there is no indication of any potential risks to these SICK products.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd sick_psirt NVD CVE.org MITRE

published 2024-03-07modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan