CVE-2026-24830
Published: 27 January 2026
Summary
CVE-2026-24830 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 19.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates identification, reporting, and correction of flaws like this integer overflow in IronOS firmware via timely patching to v2.23-rc2.
Enforces validation of information inputs to prevent integer overflows or wraparounds that remote attackers could exploit over the network.
Requires vulnerability scanning to identify the presence of CVE-2026-24830 in vulnerable IronOS firmware versions before exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated network exploitation of integer overflow in exposed firmware service enables initial access via public-facing application exploitation.
NVD Description
Integer Overflow or Wraparound vulnerability in Ralim IronOS.This issue affects IronOS: before v2.23-rc2.
Deeper analysisAI
CVE-2026-24830 is an Integer Overflow or Wraparound vulnerability (CWE-190) in Ralim's IronOS firmware. This issue affects IronOS versions before v2.23-rc2 and was published on 2026-01-27.
The vulnerability has a CVSS v3.1 base score of 9.8 (Critical), with vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Remote attackers require no privileges or user interaction and can exploit it over the network with low complexity, potentially achieving high impacts on confidentiality, integrity, and availability.
The GitHub pull request at https://github.com/Ralim/IronOS/pull/2083 provides a patch addressing the issue, with IronOS v2.23-rc2 mitigating the vulnerability.
Details
- CWE(s)