« Volver al listado

CVE-2024-41260

Estado: AplazadaAlta (7.5)—

Un vector de inicialización estático (IV) en la función de cifrado de netbird v0.28.4 permite a los atacantes obtener información confidencial.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Netbird — Management ServiceAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-41260",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-41260",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-08-06T18:05:31.126751Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:netbirdio:netbird:0.28.4:*:*:*:*:*:*:*"
          ],
          "vendor": "netbirdio",
          "product": "netbird",
          "versions": [
            {
              "status": "affected",
              "version": "0.28.4"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-08-01T16:15:06.453",
  "references": [
    {
      "url": "https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/github/advisory-database/pull/5714",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/netbirdio/netbird/pull/2569",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-321"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database."
    },
    {
      "lang": "es",
      "value": "Un vector de inicialización estático (IV) en la función de cifrado de netbird v0.28.4 permite a los atacantes obtener información confidencial."
    }
  ],
  "lastModified": "2026-06-17T07:47:31.610",
  "sourceIdentifier": "cve@mitre.org"
}