CVE-2024-44097
CRITICALDescription
According to the researcher: "The TLS connections are encrypted against tampering or eavesdropping. However, the application does not validate the server certificate properly while initializing the TLS connection. This allows for a network attacker to intercept the connection and read the data. The attacker could the either send the client a malicious response, or forward the (possibly modified) data to the real server."
Is your site exposed to CVE-2024-44097?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| nest_doorbell_\(battery\)_firmware | |
| nest_doorbell_\(battery\) | |
| nest_cam_\(outdoor_or_indoor\,_battery\)_firmware | |
| nest_cam_\(outdoor_or_indoor\,_battery\) | |
| nest_cam_with_floodlight_firmware | |
| nest_cam_with_floodlight | |
| nest_cam_\(indoor\,_wired\)_firmware | |
| nest_cam_\(indoor\,_wired\) |
References
Frequently Asked Questions
What is CVE-2024-44097? +
How severe is CVE-2024-44097? +
What products are affected by CVE-2024-44097? +
How do I check if I'm vulnerable to CVE-2024-44097? +
Related Vulnerabilities
A security vulnerability has been identified in Acer Care Center where the ACCSvc service creates a Named Pipe with a …
NitroSense 3.x before 3.01.3052 contains Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a custom …
Local privilege escalation potentially allowed an attacker to write an arbitrary file with fully controlled content as a privileged user.
Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo` in Loytec LIP-ME201C, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS and L-PAD through 8.4.16 on …
PredatorSense version 3.00.3136 to 3.00.3196 contain Local Privilege Escalation (LPE) vulnerability.The program exposes a Windows Named Pipe that uses a …
A privilege escalation vulnerability in Palo Alto Networks Cortex® XDR Broker VM enables a locally authenticated user to perform actions …