CVE-2024-10604

Name: CVE-2024-10604
Creator: NVD / NIST
Published: 2025-01-30T20:15:33.003+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.9/10EPSS 0.22%

Last modified Jun 17, 2026

CVE-2024-10604 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances. EPSS estimates a 0.22% chance of exploitation in the next 30 days.

Description

Vulnerabilities in the algorithms used by Fuchsia to populate network protocol header fields, specifically the TCP ISN, TCP timestamp, TCP and UDP source ports, and IPv4/IPv6 fragment ID allow for these values to be guessed under circumstances

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS 4.0

6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.22%

12.6th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-330

Affected Software

Vendor	Product	Versions
Google	Fuchsia	< f16
Google	Fuchsia	>= f17, < f20

References

https://fuchsia.googlesource.com/fuchsia/+/40e7fbcdcd013441daf4492f1ead349a9e5b80dcPatch
https://fuchsia.googlesource.com/fuchsia/+/a3c17a4d6b3140f9175d6cf6ac4eb4e775f8dea8Patch
https://www.ndss-symposium.org/wp-content/uploads/2025-122-paper.pdfExploit, Mitigation, Third Party Advisory

Timeline

Published: Jan 30, 2025
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2024-10604?

How severe is CVE-2024-10604?

CVE-2024-10604 has a CVSS score of 6.9/10 (MEDIUM severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2024-10604?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2024-10604?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST