CVE-2024-29998: 
vulnerability analysis and mitigation

Windows Mobile Broadband Driver Remote Code Execution Vulnerability (CVE-2024-29998) was disclosed on May 14, 2024. This vulnerability affects multiple versions of Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server editions (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.8 (Medium) with the following vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Microsoft has classified this as a CWE-20 (Improper Input Validation) type vulnerability (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute remote code on affected systems, potentially gaining high levels of access to confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires physical access (AV:P) with low attack complexity (AC:L) and no privileges (PR:N) or user interaction (UI:N) to exploit (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB5037765 for Windows 10 1809 and Windows Server 2019, KB5037768 for Windows 10 21H2/22H2, KB5037770/KB5037771 for Windows 11, and KB5037781/KB5037782 for Windows Server 2022 (Rapid7).