CVE-2024-29997: 
vulnerability analysis and mitigation

CVE-2024-29997 is a Windows Mobile Broadband Driver Remote Code Execution Vulnerability that was initially disclosed on May 14, 2024. This vulnerability affects multiple versions of Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions (NVD).

The vulnerability has been classified with a CVSS v3.1 Base Score of 6.8 (Medium) with the following vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vulnerability is categorized under CWE-190 (Integer Overflow or Wraparound) (NVD).

This vulnerability could potentially allow an attacker to execute remote code on affected systems through the Windows Mobile Broadband Driver, potentially compromising the confidentiality, integrity, and availability of the system as indicated by the high impact scores in the CVSS metrics (Microsoft).

The vulnerability requires physical access (AV:P) with low attack complexity (AC:L) and no privileges (PR:N) or user interaction (UI:N) to exploit, as indicated by the CVSS metrics (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB5037765 for Windows 10 1809, KB5037768 for Windows 10 21H2/22H2, KB5037770 for Windows 11 21H2, KB5037771 for Windows 11 22H2/23H2, and KB5037782 for Windows Server 2022 (Rapid7).