« Volver al listado

CVE-2024-45750

Estado: AplazadaAlta (7.3)—

An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5.007 (and older), Android VPN Client 6.4.5 (and older) VPN Client Linux 3.4 (and older), VPN Client MacOS 2.4.10 (and older) allows a remote attacker to execute arbitrary code via the IKEv2 Authentication phase, it accepts malformed ECDSA signatures and establishes the tunnel.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (5)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Thegreenbowvpn — Android VPN ClientAIThegreenbowvpn — VPN Client LinuxAIThegreenbowvpn — VPN Client MacosAIThegreenbowvpn — Windows Enterprise VPN ClientAIThegreenbowvpn — Windows Standard VPN ClientAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-45750",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-45750",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-26T18:48:36.428721Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.3,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:thegreenbow:android_vpn:*:*:*:*:*:*:*:*"
          ],
          "vendor": "thegreenbow",
          "product": "android_vpn",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "6.4.5"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:thegreenbow:vpn_client_linux:*:*:*:*:*:*:*:*"
          ],
          "vendor": "thegreenbow",
          "product": "vpn_client_linux",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.4"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:thegreenbow:windows_standard_vpn:*:*:*:*:*:*:*:*"
          ],
          "vendor": "thegreenbow",
          "product": "windows_standard_vpn",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "6.87.108"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:thegreenbow:windows_enterprise_vpn:*:*:*:*:*:*:*:*"
          ],
          "vendor": "thegreenbow",
          "product": "windows_enterprise_vpn",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "7.5.007"
            }
          ],
          "defaultStatus": "unknown"
        },
        {
          "cpes": [
            "cpe:2.3:a:thegreenbow:vpn_client_macos:*:*:*:*:*:*:*:*"
          ],
          "vendor": "thegreenbow",
          "product": "vpn_client_macos",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.10"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2024-09-25T18:15:05.043",
  "references": [
    {
      "url": "https://thegreenbow.com",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.thegreenbow.com/en/support/security-alerts/#deeplink-17024",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-287"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in TheGreenBow Windows Standard VPN Client 6.87.108 (and older), Windows Enterprise VPN Client 6.87.109 (and older), Windows Enterprise VPN Client 7.5.007 (and older), Android VPN Client 6.4.5 (and older) VPN Client Linux 3.4 (and older), VPN Client MacOS 2.4.10 (and older) allows a remote attacker to execute arbitrary code via the IKEv2 Authentication phase, it accepts malformed ECDSA signatures and establishes the tunnel."
    },
    {
      "lang": "es",
      "value": "Un problema en TheGreenBow Windows Standard VPN Client 6.87.108 (y anteriores), Windows Enterprise VPN Client 6.87.109 (y anteriores), Windows Enterprise VPN Client 7.5.007 (y anteriores), Android VPN Client 6.4.5 (y anteriores), VPN Client Linux 3.4 (y anteriores), VPN Client MacOS 2.4.10 (y anteriores) permite a un atacante remoto ejecutar código arbitrario a través de la fase de autenticación IKEv2, acepta firmas ECDSA malformadas y establece el túnel."
    }
  ],
  "lastModified": "2026-06-17T07:54:44.580",
  "sourceIdentifier": "cve@mitre.org"
}