CVE-2024-28250
Cilium 1.14.0 – 1.14.8
Raw vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NSummary
CVE-2024-28250 is a medium-severity Missing Encryption of Sensitive Data (CWE-311) vulnerability in Cilium Cilium. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Network Sniffing (T1040); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-28 (Protection of Information at Rest) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1011
Vulnerability Data
Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions 1.14.8 and 1.15.2, In Cilium clusters with WireGuard enabled and traffic matching Layer 7 policies Wireguard-eligible traffic that is sent…
more
between a node's Envoy proxy and pods on other nodes is sent unencrypted and Wireguard-eligible traffic that is sent between a node's DNS proxy and pods on other nodes is sent unencrypted. This issue has been resolved in Cilium 1.14.8 and 1.15.2 in in native routing mode (`routingMode=native`) and in Cilium 1.14.4 in tunneling mode (`routingMode=tunnel`). Not that in tunneling mode, `encryption.wireguard.encapsulate` must be set to `true`. There is no known workaround for this issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 7 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-13 mandates use of specific cryptography, structurally preventing unencrypted sensitive data.
SC-8 directly requires protecting confidentiality of transmitted information, which structurally eliminates cleartext transmission of sensitive data.
SC-28 requires cryptographic protection of information at rest, eliminating the storage half of the weakness.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Encryption of data-in-transit directly prevents cleartext transmission while the control also addresses integrity and availability.
PR.DS-01 directly mandates encryption for data-at-rest and therefore prevents CWE-311 mostly for storage, yet the weakness also spans transmission and other contexts that this single at-rest control leaves unaddressed.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Specifying encryption and other security technology for network services prevents transmission of sensitive information in cleartext over potentially untrusted channels.
Explicit rules requiring encryption for sensitive information in transit eliminate the weakness of sending data without cryptographic protection.
Specifying communications-security requirements and secure remote-access methods (including encryption expectations) prevents the transmission of sensitive data in cleartext over home or public networks.
Armoured conduits, electromagnetic shielding and locked enclosures make passive eavesdropping on unencrypted traffic traversing the cables more difficult, mitigating exposure of sensitive data in transit.
Explicitly calling for protection of data in transit and at rest, plus secure encryption of communications, drives the implementation of encryption that prevents clear-text exposure of sensitive information.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-311
Oracle Linux 9 (1 rule)
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 8 (1 rule)
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
RHEL 9 (1 rule)
- V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-311
Windows Server 2016 (1 rule)
- V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311
Windows Server 2019 (1 rule)
- V-205727 Windows Server 2019 systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-311