« Volver al listado

CVE-2024-2873

Estado: AnalizadaCrítica (9.1)—

A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wolfssh — Wolfssh

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-2873",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-2873",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-01T19:41:19.753078Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "facts@wolfssl.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "facts@wolfssl.com",
      "affectedData": [
        {
          "repo": "https://github.com/wolfSSL/wolfssh",
          "vendor": "wolfSSL Inc.",
          "product": "wolfSSH",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "release bundle",
              "lessThanOrEqual": "v1.4.16"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*"
          ],
          "vendor": "wolfssh",
          "product": "wolfssh",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "1.4.16",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-03-25T22:37:19.847",
  "references": [
    {
      "url": "https://github.com/wolfSSL/wolfssh/pull/670",
      "tags": [
        "Issue Tracking"
      ],
      "source": "facts@wolfssl.com"
    },
    {
      "url": "https://github.com/wolfSSL/wolfssh/pull/671",
      "tags": [
        "Issue Tracking"
      ],
      "source": "facts@wolfssl.com"
    },
    {
      "url": "https://www.wolfssl.com/docs/security-vulnerabilities/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "facts@wolfssl.com"
    },
    {
      "url": "https://github.com/wolfSSL/wolfssh/pull/670",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/wolfSSL/wolfssh/pull/671",
      "tags": [
        "Issue Tracking"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.wolfssl.com/docs/security-vulnerabilities/",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "facts@wolfssl.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.\n"
    },
    {
      "lang": "es",
      "value": "Se encontró una vulnerabilidad en la máquina de estado del lado del servidor de wolfSSH antes de las versiones 1.4.17. Un cliente malintencionado podría crear canales sin realizar primero la autenticación del usuario, lo que provocaría un acceso no autorizado."
    }
  ],
  "lastModified": "2026-06-17T07:25:43.723",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wolfssh:wolfssh:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9F84F99B-681F-43B2-BEA5-B3ED6BFABC3D",
              "versionEndExcluding": "1.4.17"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "facts@wolfssl.com"
}