CVE-2024-2873— User authentication bypass in wolfSSH server
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-2873
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
User authentication bypass in wolfSSH server
Source: NVD (National Vulnerability Database)
Vulnerability Description
A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
认证机制不恰当
Source: NVD (National Vulnerability Database)
Vulnerability Title
wolfSSH 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
wolfSSH是一个小型、快速、可移植的 SSH 实现，包括对 SCP 和 SFTP 的支持。 wolfSSH 1.4.17之前版本存在安全漏洞。攻击者利用该漏洞可以在不首先执行用户身份验证的情况下创建通道，从而导致未经授权的访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Shenlong Deep Dive — AI Deep Analysis
10-question deep dive: root cause, exploitation, mitigation, urgency. Read summary free, full version requires login.
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| wolfSSL Inc. | wolfSSH | 0 ~ v1.4.16 | - |
II. Public POCs for CVE-2024-2873
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | None | https://github.com/stuxbench/dropbear-cve-2024-2873 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-2873
请登录查看更多情报信息。
- wolfSSL Security Vulnerabilities | Documentation - wolfSSLvendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-2873
IV. Related Vulnerabilities
Same product: wolfSSH
- CVE-2026-0930
Potential wolfSSHd Buffer out-of-bounds Read on Windows Hand - CVE-2025-15382
Client SCP Request Triggers Buffer Overread by 1 Byte - CVE-2025-14942
Authentication Bypass - CVE-2025-11625
Host verification bypass and credential leak - CVE-2025-11624
Buffer overwrite when processing file handles with the SFTP
Same weakness: CWE-287
- CVE-2026-8244
Industrial Application Software IAS Canias ERP Login RMI imp - CVE-2026-8216
Industrial Application Software IAS Canias ERP Java RMI Sess - CVE-2026-8214
Industrial Application Software IAS Canias ERP RMI doAction - CVE-2026-42560
auth: Patreon provider assigns the same local user ID to eve - CVE-2026-41070
openvpn-auth-oauth2 returns FUNC_SUCCESS on client-deny, all
V. Comments for CVE-2024-2873
No comments yet