Cyber Resilience

CVE-2024-56141

Published
07 July 2026
Modified
08 July 2026
CVSS Score v3.1 5.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0016 5th percentile
Risk Priority 38 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-56141 is a medium-severity Generation of Predictable IV with CBC Mode (CWE-329) vulnerability. Its CVSS base score is 5.0 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-8 (Security and Privacy Engineering Principles) and SC-13 (Cryptographic Protection) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A04:2025 Cryptographic Failures

EU & UK References

Vulnerability Data

Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key…

more

rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.

CWE(s)
CWE-329

Related Threats

MITRE ATT&CK Enterprise Techniques

T1600 Weaken Encryption Defense Impairment
Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.
attack.mitre.org →
T1600.001 Reduce Key Space Defense Impairment
Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-49783Shared CWE-329
CVE-2025-2814Shared CWE-329
CVE-2026-45787Shared CWE-329

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)
  • 1 hardening rule · 1 OS baseline
Validate
Prove the fix (OWASP ASVS)
  • V11.6.1

Mitigating Controls (NIST 800-53 r5) AI

SA-8 Security and Privacy Engineering Principles partial match

Engineering principles applied during design and implementation can mandate cryptographically secure IV generation.

SC-13 Cryptographic Protection partial match

Specifying and enforcing approved cryptographic algorithms and implementations directly requires non-predictable IVs for CBC.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce correct cryptographic implementation such as random IV generation for CBC.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.24 Use of cryptography full match
prevents

Mandates proper cryptographic controls including IV generation, directly preventing predictable-IV CBC weaknesses.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing in development can detect predictable IV usage before deployment.

A.8.25 Secure development life cycle partial match
prevents

Secure SDLC processes catch cryptographic flaws like bad IVs during design and review phases.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles guide selection of strong cryptographic primitives and IV handling.

A.8.28 Secure coding partial match
prevents

Requires secure coding practices that eliminate predictable IV usage in CBC implementations.

References