CVE-2024-6580

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-6580
The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public key or certificate (which would most likely be a separate vulnerability in the calling application). IPWorks SSH versions 22.0.8945 and 24.0.8945 were released to address this condition by blocking all filesystem and network path requests for SSH public keys or certificates.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://www.nsoftware.com/kb/articles/cve-2024-5806 Vendor Advisory
https://www.nsoftware.com/kb/articles/cve-2024-5806 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:nsoftware:ipworks_ssh:22.0.8945:*:*:*:*:.net:*:*
cpe:2.3:a:nsoftware:ipworks_ssh:24.0.8945:*:*:*:*:.net:*:*
History

26 Sep 2025, 14:19

Type Values Removed Values Added
References () https://www.nsoftware.com/kb/articles/cve-2024-5806 - () https://www.nsoftware.com/kb/articles/cve-2024-5806 - Vendor Advisory
First Time Nsoftware ipworks Ssh
Nsoftware
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CWE CWE-347
CPE cpe:2.3:a:nsoftware:ipworks_ssh:22.0.8945:*:*:*:*:.net:*:*
cpe:2.3:a:nsoftware:ipworks_ssh:24.0.8945:*:*:*:*:.net:*:*

21 Nov 2024, 09:49

Type Values Removed Values Added
References () https://www.nsoftware.com/kb/articles/cve-2024-5806 - () https://www.nsoftware.com/kb/articles/cve-2024-5806 -

09 Jul 2024, 18:19

Type Values Removed Values Added
Summary
  • (es) Se puede inducir al componente SFTPServer de la librería SSH de IPWorks del software /n a realizar solicitudes no deseadas de ruta de red o de sistema de archivos al cargar un certificado o clave pública SSH. Para ser explotable, una aplicación que llama al componente SFTPServer debe otorgar acceso al usuario sin verificar la clave pública o el certificado SSH (lo que probablemente sería una vulnerabilidad separada en la aplicación que llama). Las versiones 22.0.8945 y 24.0.8945 de IPWorks SSH se lanzaron para abordar esta condición mediante el bloqueo de todas las solicitudes de rutas de red y sistemas de archivos para claves públicas o certificados SSH.

08 Jul 2024, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-07-08 19:15

Updated : 2025-09-26 14:19

NVD link : CVE-2024-6580

Mitre link : CVE-2024-6580

CVE.ORG link : CVE-2024-6580

JSON object : View

Products Affected

nsoftware

  • ipworks_ssh
CWE
CWE-1390

Weak Authentication

CWE-347

Improper Verification of Cryptographic Signature