CVE-2024-2169

Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.cert.org/vuls/id/417980
https://www.kb.cert.org/vuls/id/417980
http://www.openwall.com/lists/oss-security/2024/09/04/1
https://kb.cert.org/vuls/id/417980
https://www.kb.cert.org/vuls/id/417980

Configurations

No configuration.

History

No history.

Information

Published : 2024-03-19 20:15

Updated : 2026-06-17 07:23

NVD link : CVE-2024-2169

Mitre link : CVE-2024-2169

CVE.ORG link : CVE-2024-2169

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-2169", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-2169", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T16:48:38.161456Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cret@cert.org", "affectedData": [{"vendor": "MikroTik", "product": "RouterOS-TFTP", "versions": [{"status": "affected", "version": "*", "versionType": "custom", "lessThanOrEqual": "7.13.2"}]}, {"vendor": "Microsoft", "product": "WDS", "versions": [{"status": "affected", "version": "*"}]}, {"vendor": "dproxy-nexgen", "product": "dproxy-nexgen", "versions": [{"status": "affected", "version": "0.1", "versionType": "custom", "lessThanOrEqual": "0.5"}]}]}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "affectedData": [{"cpes": ["cpe:2.3:a:mikrotik:routeros_tftp:*:*:*:*:*:*:*:*"], "vendor": "mikrotik", "product": "routeros_tftp", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.13.2"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:microsoft:wds:*:*:*:*:*:*:*:*"], "vendor": "microsoft", "product": "wds", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "*"}], "defaultStatus": "unknown"}, {"cpes": ["cpe:2.3:a:dproxy-nexgen_project:dproxy-nexgen:-:*:*:*:*:*:*:*"], "vendor": "dproxy-nexgen_project", "product": "dproxy-nexgen", "versions": [{"status": "affected", "version": "0.1", "versionType": "custom", "lessThanOrEqual": "0.5"}], "defaultStatus": "unknown"}]}], "published": "2024-03-19T20:15:07.320", "references": [{"url": "https://kb.cert.org/vuls/id/417980", "source": "cret@cert.org"}, {"url": "https://www.kb.cert.org/vuls/id/417980", "source": "cret@cert.org"}, {"url": "http://www.openwall.com/lists/oss-security/2024/09/04/1", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://kb.cert.org/vuls/id/417980", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.kb.cert.org/vuls/id/417980", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "Implementations of UDP application protocol are vulnerable to network loops. An unauthenticated attacker can use maliciously-crafted packets against a vulnerable implementation that can lead to Denial of Service (DOS) and/or abuse of resources."}, {"lang": "es", "value": "Las implementaciones de UDP application protocol son vulnerables a los bucles de red. Un atacante no autenticado puede utilizar paquetes manipulados con fines malintencionados contra una implementaci\u00f3n vulnerable que puede provocar una denegaci\u00f3n de servicio (DOS) y/o un abuso de recursos."}], "lastModified": "2026-06-17T07:23:51.480", "sourceIdentifier": "cret@cert.org"}