{"id":"CVE-2024-57972","aliases":["EUVD-2024-54280","GHSA-xfr2-g2r2-vf88"],"status":"published","title":"A vulnerability in the pairing request method in Microsoft HoloLens 1 and 2 - Windows Holographic...","description":"The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1244 allows remote attackers to cause a Denial of Service (resource consumption and device unusability) by sending many requests through the Device Portal framework.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02635,"percentile":0.85678,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-770"],"published":"2025-03-06T00:00:00Z","modified":"2026-06-17T08:14:20Z","exploits":[{"source":"pocgithub","id":"tania-silva/CVE-2024-57972","title":"tania-silva/CVE-2024-57972","date":"2025-03-07","url":"https://github.com/tania-silva/CVE-2024-57972"}],"products":[{"vendor":"microsoft","product":"hololens"}],"references":[{"url":"https://github.com/tania-silva/Hololens","tags":["exploit"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57972"},{"url":"https://github.com/advisories/GHSA-xfr2-g2r2-vf88"}],"sources":{"cve":[{"id":"CVE-2024-57972","description":"The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1244 allows remote attackers to cause a Denial of Service (resource consumption and device unusability) by sending many requests through the Device Portal framework.","status":"published","published":"2025-03-06T00:00:00Z","modified":"2025-03-07T18:01:18.31Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-54280","description":"The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1244 allows remote attackers to cause a Denial of Service (resource consumption and device unusability) by sending many requests through the Device Portal framework.","status":"published","published":"2025-03-06T00:00:00Z","modified":"2025-03-07T18:01:18Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-xfr2-g2r2-vf88","title":"A vulnerability in the pairing request method in Microsoft HoloLens 1 and 2 - Windows Holographic...","description":"A vulnerability in the pairing request method in Microsoft HoloLens 1 and 2 - Windows Holographic 10.0.17763.3046 through 10.0.22621.1244 allows remote attackers to cause a Denial of Service via the Device Portal framework.","status":"published","published":"2025-03-06T21:31:27Z","modified":"2025-03-07T00:32:57Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T15:00:10.810827Z"}],"nvd":[{"id":"CVE-2024-57972","description":"The pairing API request handler in Microsoft HoloLens 1 (Windows Holographic) through 10.0.17763.3046 and HoloLens 2 (Windows Holographic) through 10.0.22621.1244 allows remote attackers to cause a Denial of Service (resource consumption and device unusability) by sending many requests through the Device Portal framework.","status":"published","published":"2025-03-06T21:15:14.687Z","modified":"2026-06-17T08:14:20.923Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:10:45.422466Z"}]}}