CVE-2024-42642
MediumCVSS 6.7Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A buffer overflow vulnerability in Micron Crucial MX500 Series SSDs (firmware M3CR046) allows an attacker to send specially crafted ATA packets from the host to the drive controller, potentially leading to uncontrolled device behavior. The vendor states that this vulnerability was fully remediated in December 2024, and updated firmware is available through Crucial's official support page.
Risk Assessment
The risk involves potential local or remote control over the drive by an attacker, which could lead to data loss, file system corruption, or privilege escalation in the IT environment.
Recommendation
Immediately update the firmware of Crucial MX500 SSDs to the latest version available on Crucial's official support page. Perform a data backup before the update.
Original NVD description (English source)
Micron Crucial MX500 Series Solid State Drives M3CR046 is vulnerable to Buffer Overflow, which can be triggered by sending specially crafted ATA packets from the host to the drive controller. NOTE: The supplier states that this vulnerability was fully remediated in December 2024 and that updated firmware is available through Crucial’s official support page.