cve-2024-53845
Vulnerability from cvelistv5
Published
2024-12-11 22:35
Modified
2024-12-12 16:35
Severity ?
6.6 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Summary
ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.
References
security-advisories@github.comhttps://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2
security-advisories@github.comhttps://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9
security-advisories@github.comhttps://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7
security-advisories@github.comhttps://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr
security-advisories@github.comhttps://github.com/espressif/esp-idf/tree/master/components/esp_wifi
Impacted products
Vendor Product Version
espressif esp-idf Version: >= 5.3.0, < 5.3.2
Version: >= 5.2.0, < 5.2.4
Version: >= 5.1.0, < 5.1.6
Version: < 5.0.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
   containers: {
      adp: [
         {
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2024-53845",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "partial",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-12-12T16:34:50.853994Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-12-12T16:35:00.685Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
      ],
      cna: {
         affected: [
            {
               product: "esp-idf",
               vendor: "espressif",
               versions: [
                  {
                     status: "affected",
                     version: ">= 5.3.0, < 5.3.2",
                  },
                  {
                     status: "affected",
                     version: ">= 5.2.0, < 5.2.4",
                  },
                  {
                     status: "affected",
                     version: ">= 5.1.0, < 5.1.6",
                  },
                  {
                     status: "affected",
                     version: "< 5.0.8",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.",
            },
         ],
         metrics: [
            {
               cvssV4_0: {
                  attackComplexity: "LOW",
                  attackRequirements: "NONE",
                  attackVector: "NETWORK",
                  baseScore: 6.6,
                  baseSeverity: "MEDIUM",
                  privilegesRequired: "NONE",
                  subAvailabilityImpact: "NONE",
                  subConfidentialityImpact: "NONE",
                  subIntegrityImpact: "NONE",
                  userInteraction: "NONE",
                  vectorString: "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U",
                  version: "4.0",
                  vulnAvailabilityImpact: "NONE",
                  vulnConfidentialityImpact: "HIGH",
                  vulnIntegrityImpact: "NONE",
               },
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-327",
                     description: "CWE-327: Use of a Broken or Risky Cryptographic Algorithm",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
            {
               descriptions: [
                  {
                     cweId: "CWE-909",
                     description: "CWE-909: Missing Initialization of Resource",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-12-11T22:35:48.528Z",
            orgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
            shortName: "GitHub_M",
         },
         references: [
            {
               name: "https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr",
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr",
            },
            {
               name: "https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db",
            },
            {
               name: "https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8",
            },
            {
               name: "https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2",
            },
            {
               name: "https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9",
            },
            {
               name: "https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7",
            },
            {
               name: "https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2",
            },
            {
               name: "https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2",
            },
            {
               name: "https://github.com/espressif/esp-idf/tree/master/components/esp_wifi",
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/espressif/esp-idf/tree/master/components/esp_wifi",
            },
         ],
         source: {
            advisory: "GHSA-wm57-466g-mhrr",
            discovery: "UNKNOWN",
         },
         title: "AES/CBC Constant IV Vulnerability in ESPTouch v2",
      },
   },
   cveMetadata: {
      assignerOrgId: "a0819718-46f1-4df5-94e2-005712e83aaa",
      assignerShortName: "GitHub_M",
      cveId: "CVE-2024-53845",
      datePublished: "2024-12-11T22:35:48.528Z",
      dateReserved: "2024-11-22T17:30:02.139Z",
      dateUpdated: "2024-12-12T16:35:00.685Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
   "vulnerability-lookup:meta": {
      nvd: "{\"cve\":{\"id\":\"CVE-2024-53845\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2024-12-12T02:15:29.087\",\"lastModified\":\"2024-12-12T02:15:29.087\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.\"},{\"lang\":\"es\",\"value\":\"ESPTouch es un protocolo de conexión para dispositivos de Internet de las cosas. En el protocolo ESPTouchV2, si bien existe una opción para usar una clave AES personalizada, no existe una opción para configurar el IV (vector de inicialización) en versiones anteriores a 5.3.2, 5.2.4, 5.1.6 y 5.0.8. El IV se configura en cero y permanece constante durante toda la vida útil del producto. En el modo AES/CBC, si el IV no se inicializa correctamente, la salida cifrada se vuelve determinista, lo que genera una posible fuga de datos. Para solucionar los problemas mencionados anteriormente, la aplicación genera un IV aleatorio al activar la clave AES a partir de las versiones 5.3.2, 5.2.4, 5.1.6 y 5.0.8. Luego, este IV se transmite junto con los datos de provisión al dispositivo de provisión. El dispositivo de provisión también ha sido equipado con un analizador para el IV AES. La actualización es aplicable para todas las aplicaciones y usuarios del componente ESPTouch v2 de ESP-IDF. Como está implementado en la pila Wi-Fi ESP, no existe ninguna solución alternativa para que el usuario arregle la capa de aplicación sin actualizar el firmware subyacente.\"}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnerableSystemConfidentiality\":\"HIGH\",\"vulnerableSystemIntegrity\":\"NONE\",\"vulnerableSystemAvailability\":\"NONE\",\"subsequentSystemConfidentiality\":\"NONE\",\"subsequentSystemIntegrity\":\"NONE\",\"subsequentSystemAvailability\":\"NONE\",\"exploitMaturity\":\"UNREPORTED\",\"confidentialityRequirements\":\"NOT_DEFINED\",\"integrityRequirements\":\"NOT_DEFINED\",\"availabilityRequirements\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnerableSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedVulnerableSystemIntegrity\":\"NOT_DEFINED\",\"modifiedVulnerableSystemAvailability\":\"NOT_DEFINED\",\"modifiedSubsequentSystemConfidentiality\":\"NOT_DEFINED\",\"modifiedSubsequentSystemIntegrity\":\"NOT_DEFINED\",\"modifiedSubsequentSystemAvailability\":\"NOT_DEFINED\",\"safety\":\"NOT_DEFINED\",\"automatable\":\"NOT_DEFINED\",\"recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-327\"},{\"lang\":\"en\",\"value\":\"CWE-909\"}]}],\"references\":[{\"url\":\"https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/espressif/esp-idf/tree/master/components/esp_wifi\",\"source\":\"security-advisories@github.com\"}]}}",
      vulnrichment: {
         containers: "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-53845\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-12T16:34:50.853994Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-12T16:34:57.677Z\"}}], \"cna\": {\"title\": \"AES/CBC Constant IV Vulnerability in ESPTouch v2\", \"source\": {\"advisory\": \"GHSA-wm57-466g-mhrr\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 6.6, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"espressif\", \"product\": \"esp-idf\", \"versions\": [{\"status\": \"affected\", \"version\": \">= 5.3.0, < 5.3.2\"}, {\"status\": \"affected\", \"version\": \">= 5.2.0, < 5.2.4\"}, {\"status\": \"affected\", \"version\": \">= 5.1.0, < 5.1.6\"}, {\"status\": \"affected\", \"version\": \"< 5.0.8\"}]}], \"references\": [{\"url\": \"https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr\", \"name\": \"https://github.com/espressif/esp-idf/security/advisories/GHSA-wm57-466g-mhrr\", \"tags\": [\"x_refsource_CONFIRM\"]}, {\"url\": \"https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db\", \"name\": \"https://github.com/espressif/esp-idf/commit/4f85a2726e04b737c8646d865b44ddd837b703db\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8\", \"name\": \"https://github.com/espressif/esp-idf/commit/8fb28dcedcc49916a5206456a3a61022d4302cd8\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2\", \"name\": \"https://github.com/espressif/esp-idf/commit/d47ed7d6f814e21c5bc8997ab0bc68e2360e5cb2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9\", \"name\": \"https://github.com/espressif/esp-idf/commit/de69895f38d563e22228f5ba23fffa02feabc3a9\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7\", \"name\": \"https://github.com/espressif/esp-idf/commit/fd224e83bbf133833638b277c767be7f7cdd97c7\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2\", \"name\": \"https://github.com/EspressifApp/EsptouchForAndroid/tree/master/esptouch-v2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2\", \"name\": \"https://github.com/EspressifApp/EsptouchForIOS/tree/master/EspTouchDemo/ESPTouchV2\", \"tags\": [\"x_refsource_MISC\"]}, {\"url\": \"https://github.com/espressif/esp-idf/tree/master/components/esp_wifi\", \"name\": \"https://github.com/espressif/esp-idf/tree/master/components/esp_wifi\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"ESPTouch is a connection protocol for internet of things devices. In the ESPTouchV2 protocol, while there is an option to use a custom AES key, there is no option to set the IV (Initialization Vector) prior to versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. The IV is set to zero and remains constant throughout the product's lifetime. In AES/CBC mode, if the IV is not properly initialized, the encrypted output becomes deterministic, leading to potential data leakage. To address the aforementioned issues, the application generates a random IV when activating the AES key starting in versions 5.3.2, 5.2.4, 5.1.6, and 5.0.8. This IV is then transmitted along with the provision data to the provision device. The provision device has also been equipped with a parser for the AES IV. The upgrade is applicable for all applications and users of ESPTouch v2 component from ESP-IDF. As it is implemented in the ESP Wi-Fi stack, there is no workaround for the user to fix the application layer without upgrading the underlying firmware.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-327\", \"description\": \"CWE-327: Use of a Broken or Risky Cryptographic Algorithm\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-909\", \"description\": \"CWE-909: Missing Initialization of Resource\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2024-12-11T22:35:48.528Z\"}}}",
         cveMetadata: "{\"cveId\": \"CVE-2024-53845\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-12T16:35:00.685Z\", \"dateReserved\": \"2024-11-22T17:30:02.139Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2024-12-11T22:35:48.528Z\", \"assignerShortName\": \"GitHub_M\"}",
         dataType: "CVE_RECORD",
         dataVersion: "5.1",
      },
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.