CVE-2024-21646: Azure IoT Platform Device SDK Remote Code Execution Vulnerability
Vulnerability summary
CVE-2024-21646 is a critical (CVSS 9.8) Code Injection vulnerability in azure azure-uamqp-c. EPSS estimates a 5.11% chance of exploitation in the next 30 days, higher than 92.3% of scored vulnerabilities.
Timeline
- 09-01-2024PublishedVulnerability first disclosed.
- 16-06-2025Last modifiedVulnerability information updated.
Description
Azure uAMQP is a general purpose C library for AMQP 1.0. The UAMQP library is used by several clients to implement AMQP protocol communication. When clients using this library receive a crafted binary type data, an integer overflow or wraparound or memory safety issue can occur and may cause remote code execution. This vulnerability has been patched in release 2024-01-01.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
5.11%
Chance of exploitation in the next 30 days
Percentile
92%
Versus all other CVEs
30-day change
No change 0.00 pp
From 5.11% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
- CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
Affected systems
Suse4 products
- python-uamqp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP2< 1.5.3-150100.4.10.1
- python-uamqp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP3< 1.5.3-150100.4.10.1
- python-uamqp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4< 1.5.3-150100.4.10.1
- python-uamqp&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP5< 1.5.3-150100.4.10.1
Azure1 product
- azure-uamqp-c< 2024-01-01
Debian1 product
- azure-uamqp-pythonAll versions (No fix recorded) | < 1.6.8-1
Microsoft1 product
- azure_uamqp< 2024-01-01
Opensuse1 product
- python-uamqp&distro=openSUSE Leap 15.5< 1.5.3-150100.4.10.1
Ubuntu1 product
- azure-uamqp-pythonAll versions (No fix recorded)
6 vendors · 9 products
References
11 links- github.com/Azure/azure-uamqp-c/security/advisories/GHSA-j29m-p99g-7hpvX Refsource CONFIRMREPORTVendor Advisory
- github.com/Azure/azure-uamqp-c/commit/12ddb3a31a5a97f55b06fa5d74c59a1d84ad78feX Refsource MISCREPORTPatch
