Security Resilience

CVE-2024-0723

Freesshd 1.0.9

Public PoC
Published
19 January 2024
Modified
21 November 2024
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS Score 0.036 89th percentile
Risk Priority 50 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-0723 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Freesshd Freesshd. Its CVSS base score is 5.3 (Medium).

Operationally, ranked in the top 11% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

A vulnerability was found in freeSSHd 1.0.9 on Windows. It has been classified as problematic. This affects an unknown part. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed…

more

to the public and may be used. The associated identifier of this vulnerability is VDB-251547.

CWE(s)
CWE-404

Related Threats

CVEs Like This One

CVE-2023-1187Same product: Microsoft Windows
CVE-2023-2874Same product: Microsoft Windows
CVE-2023-1188Same product: Microsoft Windows
CVE-2024-0725Same product: Microsoft Windows
CVE-2018-8120Same vendor: Microsoft
CVE-2018-8405Same vendor: Microsoft
CVE-2018-8406Same vendor: Microsoft
CVE-2018-8611Same vendor: Microsoft
CVE-2018-8639Same vendor: Microsoft
CVE-2024-45182Same product: Microsoft Windows

Affected Assets

freesshd
freesshd
1.0.9

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover missing or incorrect resource releases after code is written.

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles can require explicit resource acquisition/release patterns that stop improper shutdown from being introduced.

SC-6 Resource Availability partial match

Priority-based resource allocation limits the blast radius when released resources are not returned to the pool.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.37 Documented operating procedures partial match
blocks

documenting procedures for secure operation, error handling, restart/recovery and resource management (including references to 8.13/8.18) is a governance and dependency control that does not itself stop exploitation of a resource-shutdown flaw; any prevention would require other controls (e.g. code changes or runtime enforcement) configured to act on it

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-404, a class-level weakness, and none of its children carries one either.

References