CVE-2024-23943
Published: 18 March 2025
Summary
CVE-2024-23943 is a critical-severity Missing Authentication for Critical Function (CWE-306) vulnerability in Vde (inferred from references). Its CVSS base score is 9.1 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 37.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and IA-8 (Identification and Authentication (Non-organizational Users)).
Deeper analysis
CVE-2024-23943 is a high-severity vulnerability stemming from a lack of authentication for a critical function in affected devices, classified under CWE-306 (Missing Authentication for Critical Function). This flaw enables unauthenticated remote attackers to gain access to the cloud API. The vulnerability carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), indicating high impacts on confidentiality and integrity but no effect on availability. It was published on 2025-03-18.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity and no user interaction or privileges required. Successful exploitation provides unauthorized access to the cloud API, allowing potential compromise of sensitive data and manipulation of API functions.
Mitigation details are outlined in the VDE CERT advisory available at https://cert.vde.com/en/advisories/VDE-2024-010.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-21373
Vulnerability details
An unauthenticated remote attacker can gain access to the cloud API due to a lack of authentication for a critical function in the affected devices. Availability is not affected.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a missing authentication flaw (CWE-306) in a cloud API exposed to remote attackers, directly enabling initial access by exploiting a public-facing application without credentials or user interaction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses missing authentication for critical functions by requiring identification of such functions, risk assessment, and restriction or monitoring of unauthenticated access to the cloud API.
Mandates unique identification and authentication of system services, directly mitigating unauthenticated access to the vulnerable cloud API function.
Requires identification and authentication for non-organizational users, preventing unauthenticated remote attackers from exploiting the cloud API.