{"cve":"CVE-2024-42483","nvd":{"published":"2024-09-12T15:18:22.093","modified":"2026-06-17T07:49:32.333","status":"Analyzed","description":"ESP-NOW Component provides a connectionless Wi-Fi communication protocol. An replay attacks vulnerability was discovered in the implementation of the ESP-NOW because the caches is not differentiated by message types, it is a single, shared resource for all kinds of messages, whether they are broadcast or unicast, and regardless of whether they are ciphertext or plaintext. This can result an attacker to clear the cache of its legitimate entries, there by creating an opportunity to re-inject previously captured packets. This vulnerability is fixed in 2.5.2.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":6.5},"cwes":["CWE-345","CWE-349"],"references":["https://github.com/espressif/esp-now/commit/4e30db50d541b2909d278ef0db05de1a3d7190ef","https://github.com/espressif/esp-now/security/advisories/GHSA-wf6q-c2xr-77xj"],"products":["espressif:esp-now"],"source":"nvd","synced_at":"2026-10-19T21:54:38.012257375+00:00"},"epss":{"cve":"CVE-2024-42483","score":0.00301,"percentile":0.22831,"date":"2026-11-01"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}