CVE-2024-4871
Raw vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:NSummary
CVE-2024-4871 is a medium-severity Key Exchange without Entity Authentication (CWE-322) vulnerability. Its CVSS base score is 6.8 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Adversary-in-the-Middle (T1557); ranked at the 46th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-3 (Device Identification and Authentication) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-44561
Vulnerability Data
A vulnerability was found in Satellite. When running a remote execution job on a host, the host's SSH key is not being checked. When the key changes, the Satellite still connects it because it uses "-o StrictHostKeyChecking=no". This flaw can…
more
lead to a man-in-the-middle attack (MITM), denial of service, leaking of secrets the remote execution job contains, or other issues that may arise from the attacker's ability to forge an SSH key. This issue does not directly allow unauthorized remote execution on the Satellite, although it can leak secrets that may lead to it.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V12.1.3
Mitigating Controls (NIST 800-53 r5) AI
Requiring device identification and authentication before establishing connections prevents unauthenticated key exchanges with unknown devices.
Requiring unique identification and authentication of users before any privileged action stops key exchange from occurring with unauthenticated parties.
Requiring identification and authentication of non-organizational users blocks key exchange with unauthenticated external actors.
Requiring proper cryptographic key establishment and management directly stops unauthenticated key-exchange implementations.
Issuing or obtaining PKI certificates under an approved policy supplies the entity authentication missing from unauthenticated key exchange.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Requiring authentication of services/hardware prevents unauthenticated key exchange.
Identity proofing and binding directly supports verifying actors before key exchange.
Verifying identity assertions mitigates the missing entity authentication in key exchange.
Protecting data-in-transit implies use of authenticated key exchange but does not explicitly require entity authentication.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography mandates authenticated key-exchange mechanisms, directly addressing the lack of entity authentication.
Security testing can detect missing entity authentication during key exchange.
Secure authentication directly prevents unauthenticated key exchange by requiring verified identities before keys are established.
Identity management provides the verified identities required before key exchange occurs.
Network security policies can require authenticated channels, indirectly reducing the risk of unauthenticated key exchange.
Security of network services includes requirements for authenticated key exchange in service protocols.