Windows security hole allows attackers to install malware via Wi-Fi — new patch plugs gaping vulnerability

News
By published

If you log into public Wi-Fi hotspots, like those at airports, hotels, and cafes, your unpatched PC could be vulnerable.

A hacker with a hood up looking at a computer screen.
(Image credit: Shutterstock)

Microsoft recently plugged a security hole in the Windows Wi-Fi driver. This exploit would have allowed attackers to run malicious code on vulnerable systems over Wi-Fi. The vulnerability affects all modern versions of Windows and Windows Server, and the attacker doesn’t need to have had prior access to the target computer.

While Microsoft acknowledges there were no known active exploits of the security hole, the weakness is described as having a low attack complexity. It’s described in CVE-2024-30078 with a maximum severity of “Important.” An attacker need only be within Wi-Fi range of the computer to send a specially crafted network packet to the target PC and exploit the vulnerability.

Microsoft considers exploitation of the vulnerability “less likely,” but these announcements often bring bad actors out of the woodwork. The ease with which someone could take advantage of the exploit is also troublesome. The weakness, categorized as an Improper Input Validation security vulnerability, exists on all common versions of Windows.

Jeff Butts
Jeff Butts
Contributing Writer

Jeff Butts has been covering tech news for more than a decade, and his IT experience predates the internet. Yes, he remembers when 9600 baud was “fast.” He especially enjoys covering DIY and Maker topics, along with anything on the bleeding edge of technology.