What’s Vulnerable › Vulnerabilities

CVE-2024-41260

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-01 · updated 2026-06-17
• Weakness: CWE-321

Description

A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Affected products

• Netbirdio Netbird: 0.28.4

References

• https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636
• https://github.com/github/advisory-database/pull/5714
• https://github.com/netbirdio/netbird/pull/2569

Get alerted when CVE-2024-41260 or the next vulnerability affects your stack