Cyber Resilience

CVE-2024-10082

Auth Bypass in Ericsson Codechecker ≤ 6.24.2

Auth BypassCrypto Weakness
Published
06 November 2024
Modified
14 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 8.7
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
EPSS Score 0.0047 39th percentile
Risk Priority 61 floored blend · peak EPSS

Summary

CVE-2024-10082 is a high-severity Authentication Bypass by Primary Weakness (CWE-305) vulnerability in Ericsson Codechecker. Its CVSS base score is 8.7 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Valid Accounts (T1078); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-2 (Account Management) and IA-2 (Identification and Authentication (Organizational Users)) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic FailuresA07:2025 Authentication Failures

EU & UK References

Vulnerability Data

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1…

more

is generated in a weak manner, cannot be disabled, and has universal access.This vulnerability allows an attacker who can create an account on an enabled external authentication service, to log in as the root user, and access and control everything that can be controlled via the web interface. The attacker needs to acquire the username of the root user to be successful. This issue affects CodeChecker: through 6.24.1.

CWE(s)
CWE-305CWE-330CWE-842

Related Threats

MITRE ATT&CK Enterprise Techniques

T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1606 Forge Web Credentials Credential Access
Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.
attack.mitre.org →
T1606.001 Web Cookies Credential Access
Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.
attack.mitre.org →
T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-53829Same product: Ericsson Codechecker
CVE-2023-49793Same product: Ericsson Codechecker
CVE-2025-40843Same product: Ericsson Codechecker
CVE-2026-25660Same product: Ericsson Codechecker
CVE-2024-10081Same product: Ericsson Codechecker
CVE-2025-1300Same product: Ericsson Codechecker
CVE-2025-40842Same vendor: Ericsson
CVE-2025-27259Same vendor: Ericsson
CVE-2025-27261Same vendor: Ericsson
CVE-2026-25658Same vendor: Ericsson

Affected Assets

ericsson
codechecker
≤ 6.24.2

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 21 hardening rules · 11 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V6.4.3
  • V7.2.4

Mitigating Controls (NIST 800-53 r5) AI

AC-2 Account Management good match

AC-2 requires documented procedures for establishing and modifying group memberships, directly stopping incorrect group placement during account provisioning.

IA-2 Identification and Authentication (Organizational Users) good match

Requires unique identification and authentication of users, structurally blocking bypass of the mechanism.

IA-8 Identification and Authentication (Non-organizational Users) good match

Requires unique identification and authentication of non-organizational users, blocking bypass paths.

SC-12 Cryptographic Key Establishment and Management good match

SC-12 requires proper cryptographic key establishment and management, which structurally mandates use of sufficient randomness for key generation.

AC-3 Access Enforcement partial match

Enforces approved authorizations so a bypass weakness cannot be exploited to reach resources.

AC-6 Least Privilege partial match

AC-6 requires that privileges (including those granted via groups) be assigned according to the principle of least privilege, reducing the chance of erroneous group placement.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure development practices throughout the SDLC prevent the primary weaknesses that enable authentication bypass.

PR.AA-03 mostly match
prevents

Strong authentication mechanisms and policy enforcement directly reduce bypass opportunities arising from implementation flaws.

PR.AA-05 mostly match
prevents

Policy-driven management, enforcement, and review of authorizations directly addresses incorrect group assignments.

ID.RA-01 partial match
prevents

Identifying and recording vulnerabilities catches the primary weaknesses that allow authentication bypass.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.16 Identity management mostly match
degrades

Identity management process governs group provisioning and de-provisioning, directly addressing incorrect placement.

A.5.18 Access rights mostly match
prevents

Access rights control explicitly requires review and approval of group memberships, preventing erroneous placement.

A.8.2 Privileged access rights mostly match
prevents

Privileged access rights depend on correct groups, yet the control focuses on elevated privileges rather than group assignment accuracy.

A.8.24 Use of cryptography mostly match
prevents

Cryptographic controls require use of approved, sufficiently random values for keys and nonces.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect authentication bypass conditions before deployment.

A.5.15 Access control partial match
prevents

Access control policy defines group membership rules but does not guarantee correct assignment.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 8 (3 rules)
  • V-248563 The OL 8 SSH server must be configured to use strong entropy. prevents CWE-330
  • V-248599 OL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
  • V-248600 OL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
Oracle Linux 9 (1 rule)
  • V-271511 OL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 8 (3 rules)
  • V-244527 RHEL 8 must have the packages required to use the hardware random number generator entropy gatherer service. prevents CWE-330
  • V-230253 RHEL 8 must ensure the SSH server uses strong entropy. prevents CWE-330
  • V-230285 RHEL 8 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
RHEL 9 (1 rule)
  • V-257782 RHEL 9 must enable the hardware random number generator entropy gatherer service. prevents CWE-330
Ubuntu 22.04 (1 rule)
  • V-260470 Ubuntu 22.04 LTS, when booted, must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Ubuntu 24.04 (1 rule)
  • V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. prevents CWE-305
Windows 10 (1 rule)
  • V-220712 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-842
Windows 11 (1 rule)
  • V-253269 Only accounts responsible for the administration of a system must have Administrator rights on the system. prevents CWE-842
Windows Server 2016 (2 rules)
  • V-224964 Only administrators responsible for the domain controller must have Administrator rights on the system. prevents CWE-842
  • V-225007 Only administrators responsible for the member server or standalone or nondomain-joined system must have Administrator rights on the system. prevents CWE-842
Windows Server 2019 (2 rules)
  • V-205746 Windows Server 2019 must only allow Administrators responsible for the member server or standalone or nondomain-joined system to have Administrator rights on the system. prevents CWE-842
  • V-205738 Windows Server 2019 must only allow administrators responsible for the domain controller to have Administrator rights on the system. prevents CWE-842
Windows Server 2022 (1 rule)
  • V-254385 Windows Server 2022 must only allow administrators responsible for the domain controller to have Administrator rights on the system. prevents CWE-842

References