{"uuid": "8603dcd6-bade-4000-9fa6-12d9f0b55040", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-24919", "type": "seen", "source": "https://t.me/hacking_Attack/181926", "content": "Is it helpful if your pentest report looks like when you stop ranking by CVSS and start reading it like an attacker\nhttps://www.reddit.com/r/Pentesting/comments/1ryfyrz/is_it_helpful_if_your_pentest_report_looks_like/\n\nSince there are issues attaching the CVE chaining image to the post., explaining it here... Real situation. Not hypothetical. Pentest report came back with these five CVEs: CVE-2024-24919 \u2014 Check Point VPN credential leak \u2014 CVSS 8.6 CVE-2022-1388 \u2014 F5 BIG-IP auth bypass \u2014 CVSS 9.8 CVE-2021-20016 \u2014 SonicWall SQL injection \u2014 CVSS 9.8 CVE-2023-20198 \u2014 Cisco IOS XE privilege escalation \u2014 CVSS 10.0 CVE-2023-28578 \u2014 Siemens SCALANCE memory corruption \u2014 CVSS 9.3 Team patched in CVSS order. The 10.0 first. Then the two 9.8s. Felt good. Sprint closed.\n The attacker used CVE-2024-24919. The 8.6. The one nobody rushed on. Because here is what the CVSS list does not show you.  CVE-2024-24919 leaks valid credentials from the Check Point VPN. Those credentials are exactly what CVE-2022-1388 needs to bypass F5 authentication. That bypass gives remote code execution , which is exactly what CVE-2021-20016 needs to pivot into the internal SonicWall.  From there CVE-2023-20198 is a single hop to full network control. Four CVEs. One chain.\n The entry point was the lowest score on the list. The 10.0 they patched first? Unreachable without the chain firing first.\n They patched the destination. Left the road open.\n For pentesters this is the actual conversation clients need to have. Not \"here are your critical CVEs.\"\n But \"here is the one CVE that if unpatched makes everything else reachable.\"  That is a completely different deliverable. And honestly clients act on it faster. Because it is one thing to hand someone a list of ten critical CVEs and watch their eyes glaze over. It is another thing entirely to say \"patch this one specific CVE this week and your attacker has no path in.\"  One CVE. One patch. Every route blocked. Question for the room: When you deliver a pentest report ,do your clients actually patch in the order you recommend, or do they go straight to the 9.8s regardless of what you tell them?    submitted by    /u/Silly_Stress4696  (https://www.reddit.com/user/Silly_Stress4696) \n [link] (https://i.redd.it/63tfd2oa53qg1)   [comments] (https://www.reddit.com/r/Pentesting/comments/1ryfyrz/is_it_helpful_if_your_pentest_report_looks_like/)", "creation_timestamp": "2026-09-02T01:00:29.017862Z"}