Security Resilience

CVE-2024-1224

Crypto Weakness

Crypto Weakness
Published
06 March 2024
Modified
17 June 2026
CVSS Score v3.1 7.1
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
EPSS Score 0.0012 2th percentile
Risk Priority 50 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-1224 is a high-severity Inadequate Encryption Strength (CWE-326) vulnerability in Org (inferred from references). Its CVSS base score is 7.1 (High).

Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

This vulnerability exists in USB Pratirodh due to the usage of a weaker cryptographic algorithm (hash) SHA1 in user login component. A local attacker with administrative privileges could exploit this vulnerability to obtain the password of USB Pratirodh on the…

more

targeted system. Successful exploitation of this vulnerability could allow the attacker to take control of the application and modify the access control of registered users or devices on the targeted system.

CWE(s)
CWE-326

Related Threats

CVEs Like This One

CVE-2023-23597Shared CWE-326
CVE-2023-21443Shared CWE-326
CVE-2023-47370Shared CWE-326
CVE-2024-39928Shared CWE-326
CVE-2024-40719Shared CWE-326
CVE-2025-46626Shared CWE-326
CVE-2025-12478Shared CWE-326
CVE-2023-44690Shared CWE-326
CVE-2024-52317Shared CWE-326
CVE-2024-33662Shared CWE-326

Affected Assets

Org
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SC-13 Cryptographic Protection good match

SC-13 requires selection and implementation of specific cryptographic algorithms and key lengths, directly preventing use of inadequate encryption strength.

SC-12 Cryptographic Key Establishment and Management partial match

SC-12 governs cryptographic key establishment and management, which can enforce sufficient key sizes and thereby reduce inadequate encryption strength.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography partial match
blocks

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.

  • No fine-grained STIG row for CWE-326, a class-level weakness. Rules are authored against its narrower children: CWE-328.

References