CVE-2024-41260

Published: Aug 1, 2024Modified: Jun 17, 2026Deferred

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Related CWEs

CWE-321

Use of Hard-coded Cryptographic Key

The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

References (3)

https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636

Source: cve@mitre.org

https://github.com/github/advisory-database/pull/5714

Source: cve@mitre.org

https://github.com/netbirdio/netbird/pull/2569

Source: cve@mitre.org

Timeline

No history available yet.