Cleartext Transmission Vulnerability in iXsystems TrueNAS CORE Products
CVE-2024-11946

6.5MEDIUM

Key Information:

Vendor

iXsystems

Status
Truenas Firmware
Vendor
CVE Published:
30 December 2024

What is CVE-2024-11946?

A vulnerability in iXsystems TrueNAS CORE allows network-adjacent attackers to manipulate firmware update files without any authentication. This issue stems from the use of an insecure protocol to deliver firmware updates, exposing sensitive information during transmission and enabling attackers to exploit this vulnerability alongside others to execute arbitrary code with root privileges. The handling of firmware updates fails to ensure secure deployment practices, leading to potential risks for the integrity and security of the system.

References

https://www.truenas.com/docs/core/13.0/gettingstarted/cor...
https://www.zerodayinitiative.com/advisories/ZDI-24-1644/

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

JSON
.