Is CVE-2024-29745 actively exploited?

Yes. CVE-2024-29745 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, which means exploitation in the wild has been confirmed.

Can CVE-2024-29745 be exploited remotely?

The attack vector of CVE-2024-29745 has not been classified yet.

What is the CVSS score of CVE-2024-29745?

CVE-2024-29745 has not received a CVSS score yet.

HOME VULNERABILITIESCVE-2024-29745

HIGHCISA KEVIN THE WILD

CVE-2024-29745

Published: April 4, 2024

EPSS:0.21%probability of exploitation in 30 daysPercentile:42.4th

Official Description

Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

NVD Source

CISA KEV Advisory

Android Pixel Information Disclosure Vulnerability

Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

Added to KEV: 2024-04-04Federal patch deadline: 2024-04-25

Required Action (CISA)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Risk Analysis

This information disclosure vulnerability in Android Pixel's fastboot firmware can expose sensitive information during device unlocking, flashing, and locking operations. Despite a low EPSS score of 0.00205, its inclusion in the KEV catalog confirms active exploitation, making it a serious concern.

This vulnerability has been actively exploited in the wild. Exploitation likely requires physical access to the device or a malicious application with specific permissions.

Recommended Action

Android Pixel users should apply all available security updates to their devices. Ensure devices are kept physically secure and only use trusted sources for flashing or unlocking operations.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2024-29745 requires local access, meaning attackers must already have a foothold on the target system.

Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

CISA has added CVE-2024-29745 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.