Login Request a demo
Medium severity · published Feb 6, 2025
CVE-2024-47256
Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may be used for…
6.0
CVSS
0.2%
EPSS
No
On KEV
Description
Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may be used for decryption of certain data within backup files of 2N Access Commander version 1.14 and older. 2N has released an updated version 3.3 of 2N Access Commander, where this vulnerability is mitigated. It is recommended that all customers update 2N Access Commander to the latest version.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 5% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N
2N Access Commander 1.14 and prior · source: vendor
Affected product
2A
2N Access Commander
2N
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47256
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47256
www.2n.com
https://www.2n.com/en-GB/download/cve_2024_47256_acom_3_3_v1pdf
More from 2N Access Commander
8.1
CVE-2024-47258
2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices
7.8
CVE-2024-47255
In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitrary code execution with root…
7.2
CVE-2024-47254
In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient Verification of Data Authenticity vulnerability could allow an attacker to escalate their privileges and gain…
7.2
CVE-2024-47253
In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to write files on the filesystem and…