Medium severity · published Mar 27, 2024
CVE-2024-2466
TLS certificate check bypass with mbedTLS
6.5
CVSS
1.5%
EPSS
No
On KEV
Description
libcurl did not check the server certificate of TLS connections done to a host specified as an IP address, when built to use mbedTLS. libcurl would wrongly avoid using the set hostname function when the specified hostname was given as an IP address, therefore completely skipping the certificate check. This affects all uses of TLS protocols (HTTPS, FTPS, IMAPS, POPS3, SMTPS, etc).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MA
macOS · Apple
before 12.7.6; 13.0 before 13.6.8; 14.0 before 14.6 · source: NVD
CU
curl · curl
8.6.0 through 8.6.0; 8.5.0 through 8.5.0 · source: vendor, NVD
BO
Bootstrap OS · Netapp
All versions, or not specified · source: NVD
HF
H300s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H410s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H500s Firmware · Netapp
All versions, or not specified · source: NVD
HF
H700s Firmware · Netapp
All versions, or not specified · source: NVD
LI
Libcurl · Curl
8.5.0 through 8.6.0 · source: CISA
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SN
SINEC NMS · Siemens
before V3.0 SP1 · source: CISA
SR
SINEMA Remote Connect Client · Siemens
before V3.2 SP2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-2466
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-2466
Mailing List
http://seclists.org/fulldisclosure/2024/Jul/18
Mailing List
http://seclists.org/fulldisclosure/2024/Jul/19
Mailing List
http://seclists.org/fulldisclosure/2024/Jul/20
Mailing List
http://www.openwall.com/lists/oss-security/2024/03/27/4
Vendor Advisory
https://curl.se/docs/CVE-2024-2466.html
Vendor Advisory
https://curl.se/docs/CVE-2024-2466.json
More from macOS
10.0
CVE-2025-43300
Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24201
Apple Multiple Products WebKit Out-of-Bounds Write Vulnerability
10.0
CVE-2025-24085
Apple Multiple Products Use-After-Free Vulnerability
9.8
CVE-2026-65400
Apple macOS Improper Authentication Vulnerability
9.8
CVE-2025-31200
Apple Multiple Products Memory Corruption Vulnerability