Vulnerability in /N Software Ipworks SSH Sftpserver
CVE-2024-6580
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public key or certificate (which would most likely be a separate vulnerability in the calling application). IPWorks SSH versions 22.0.8945 and 24.0.8945 were released to address this condition by blocking all filesystem and network path requests for SSH public keys or certificates.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.001 (2.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 3rd percentile — 2.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.001 · newest: 0.001 · change: 0.000
Affected products
- /N Software Ipworks SSH Sftpserver — versions 0
- Nsoftware Ipworks SSH — versions 22.0.8945, 24.0.8945
Weakness classification (CWE)
References
- 9119a7d8-5eab-497f-8521-727c672e3725 (vendor-advisory, Vendor Advisory)
Frequently asked questions
- What is CVE-2024-6580?
- CVE-2024-6580 is a medium-severity vulnerability in /N Software Ipworks SSH Sftpserver, classified under Weak Authentication. CVSS score: 6.5/10. Published 2024-07-08.
- How severe is CVE-2024-6580?
- Medium severity. CVSS v3 base score is 6.5 out of 10.