CVE-2024-35061

Summary

NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-the-middle attack. When chained with CVE-2024-35059, the CVE in subject leads to an unauthenticated, fully remote code execution.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://www.linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze
• https://github.com/advisories/GHSA-qv6x-53jj-vw59
• https://github.com/advisories/GHSA-jqff-8g2v-642h

References

• https://www.linkedin.com/pulse/remote-code-execution-via-man-in-the-middle-more-ujkze
• https://github.com/advisories/GHSA-qv6x-53jj-vw59
• https://github.com/advisories/GHSA-jqff-8g2v-642h

• ←Previous
• Next→