CVE-2024-2873 - CVE House

Status published Critical CVE-2024-2873

User authentication bypass in wolfSSH server

9.1 CVSS

Vulnerability Description

A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-2873

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from wolfSSL Inc.

View All →

CVE-2025-7844

wolfTPM library wrapper function `wolfTPM2_RsaKey_TpmToWolf` copies external data to a fixed-size stack buffer without length validation potentially causing stack-based buffer overflow

Low 1

CVE-2024-5288

Safe-error attack on TLS 1.3 Protocol

Medium 5.1

Affected Vendor

wolfSSL Inc.

View all reports →

Affected Software

wolfSSH

Vulnerable Versions:

Timeline

Official Publish: March 25th, 2024

Last Modified: August 1st, 2024

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

Initial Access

T1078 Valid Accounts

Persistence

T1556 Modify Authentication Process

Credential Access