CVE-2024-44754 describes a vulnerability in Minut M2 devices running firmware version #15142 where cryptographic keys can be extracted from internal flash memory by attackers physically near the device. This key extraction facilitates unauthorized firmware injection into other Minut M2 devices through USB connections. The vulnerability is classified under CWE-522 (Insufficiently Protected Credentials). There is no vendor advisory or patch information available, and no known exploits have been reported in the wild.

Successful exploitation allows an attacker with physical access to extract sensitive cryptographic keys, compromising device integrity and confidentiality. This enables injection of malicious firmware into other Minut M2 devices, potentially leading to full device compromise, data breach, or denial of service. The vulnerability affects confidentiality, integrity, and availability, as reflected in the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to affected devices and monitor for unauthorized USB connections. Avoid deploying devices with firmware version #15142 in sensitive environments if possible.