CVE-2024-6107
Published: 21 July 2025
Summary
CVE-2024-6107 is a critical-severity Improper Authentication (CWE-287) vulnerability in Canonical Metal As A Service. Its CVSS base score is 9.6 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation of Remote Services (T1210); ranked in the top 47.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and IA-3 (Device Identification and Authentication).
Deeper analysis
CVE-2024-6107 is a critical authentication bypass vulnerability (CWE-287) in MAAS (Metal-as-a-Service), stemming from insufficient verification of clients. It allows a malicious client to evade authentication checks and execute RPC commands within a region. The issue carries a CVSS v3.1 base score of 9.6 (AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H), indicating high severity due to its potential for significant confidentiality and availability impacts alongside a scope change.
An adjacent network attacker (AV:A) with no privileges (PR:N) can exploit this vulnerability with low complexity (AC:L) and no user interaction (UI:N). Successful exploitation enables the attacker to run arbitrary RPC commands in a MAAS region, potentially leading to high confidentiality loss (C:H), high availability disruption (A:H), and low integrity compromise (I:L).
The vulnerability has been addressed in updated versions of MAAS and the corresponding snaps. Additional details are available in the Launchpad bug report at https://bugs.launchpad.net/maas/+bug/2069094.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-54803
Vulnerability details
Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Authentication bypass (CWE-287) directly enables exploitation of the MAAS region RPC service by an unauthenticated adjacent-network attacker to execute arbitrary commands.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations and authentication checks to prevent malicious clients from bypassing verification and executing unauthorized RPC commands.
Requires identification and authentication of clients or devices prior to allowing RPC command execution, directly countering the insufficient client verification.
Mandates timely remediation of flaws like this authentication bypass through software updates, as addressed in MAAS patches.