CVE-2024-23943

Critical

Published: 18 March 2025

Published

18 March 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS Score 0.0043 62.6th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-23943 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vde (inferred from references). Its CVSS base score is 9.1 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-8 (Identification and Authentication (Non-organizational Users)).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match

prevent

Directly addresses missing authentication for critical functions by requiring identification of such functions, risk assessment, and restriction or monitoring of unauthenticated access to the cloud API.

IA-9 Service Identification and Authentication good match

prevent

Mandates unique identification and authentication of system services, directly mitigating unauthenticated access to the vulnerable cloud API function.

IA-8 Identification and Authentication (Non-organizational Users) good match

prevent

Requires identification and authentication for non-organizational users, preventing unauthenticated remote attackers from exploiting the cloud API.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a missing authentication flaw (CWE-306) in a cloud API exposed to remote attackers, directly enabling initial access by exploiting a public-facing application without credentials or user interaction.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.

Deeper analysisAI

CVE-2024-23943 is a high-severity vulnerability stemming from a lack of authentication for a critical function in affected devices, classified under CWE-306 (Missing Authentication for Critical Function). This flaw enables unauthenticated remote attackers to gain access to the cloud API. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high impacts on confidentiality and integrity but no effect on availability. It was published on 2025-03-18.

An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation provides unauthorized access to the cloud API, allowing potential compromise of sensitive data and manipulation of API functions.

Mitigation details are outlined in the VDE CERT advisory available at https://cert.vde.com/en/advisories/VDE-2024-010.