cve.bz

CVE-2024-41260

7.5 highEPSS 0.5%

High (7.5). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/netbirdio/netbird 0.29.2.

A static initialization vector (IV) in the encrypt function of netbird management's service from v0.23.2 to v0.29.1 allows attackers to obtain sensitive information (email addresses) when in possession of the audit events database.

Severity

CVSS 3.1

7.5 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWE
CWE-321
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-9v35-4xcr-w9phGogithub.com/netbirdio/netbird>=0.23.2 <0.29.20.29.2
GO-2024-3057Gogithub.com/netbirdio/netbird>=0.23.2 <0.29.20.29.2

References

Check your stackJSON