{"id":"CVE-2024-41260","state":"PUBLISHED","title":"A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresse","description":"A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.","publishedAt":"2024-08-01T00:00:00.000Z","updatedAt":"2025-12-15T16:30:48.044Z","severity":{"score":7.5,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","source":"CISA-ADP"},"assigner":"mitre","products":["n/a n/a"],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":["https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636","https://github.com/netbirdio/netbird/pull/2569","https://github.com/github/advisory-database/pull/5714"],"weaknesses":["CWE-321"],"ingestedAt":"2026-10-29T20:07:39.287Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/41xxx/CVE-2024-41260.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-41260","state":"PUBLISHED","datePublished":"2024-08-01T00:00:00.000Z","dateUpdated":"2025-12-15T16:30:48.044Z","assignerShortName":"mitre","assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateReserved":"2024-07-18T00:00:00.000Z"},"containers":{"cna":{"descriptions":[{"lang":"en","value":"A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database."}],"affected":[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}],"references":[{"url":"https://gist.github.com/nyxfqq/92232108ac153e95d538bb17fc5ad636"},{"url":"https://github.com/netbirdio/netbird/pull/2569"},{"url":"https://github.com/github/advisory-database/pull/5714"}],"problemTypes":[{"descriptions":[{"type":"text","lang":"en","description":"n/a"}]}],"providerMetadata":{"shortName":"mitre","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","dateUpdated":"2025-12-15T16:30:48.044Z"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"netbirdio","product":"netbird","defaultStatus":"unknown","versions":[{"version":"0.28.4","status":"affected"}],"cpes":["cpe:2.3:a:netbirdio:netbird:0.28.4:*:*:*:*:*:*:*"]}],"metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":7.5,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","integrityImpact":"NONE","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2024-08-06T18:05:31.126751Z","id":"CVE-2024-41260","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-321","type":"CWE","lang":"en","description":"CWE-321 Use of Hard-coded Cryptographic Key"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-08-06T18:16:11.358Z"}}]}}}