// For flags

CVE-2024-5732

Clash Proxy Port improper authentication

Severity Score

6.9
*CVSS v4

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track
*SSVC
Descriptions

A vulnerability was found in Clash up to 0.20.1 on Windows. It has been declared as critical. This vulnerability affects unknown code of the component Proxy Port. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to change the configuration settings. VDB-267406 is the identifier assigned to this vulnerability.

Se encontró una vulnerabilidad en Clash hasta 0.20.1 en Windows. Ha sido declarada crítica. Esta vulnerabilidad afecta a un código desconocido del componente Proxy Port. La manipulación conduce a una autenticación incorrecta. El ataque se puede iniciar de forma remota. El exploit ha sido divulgado al público y puede utilizarse. Se recomienda cambiar los ajustes de configuración. VDB-267406 es el identificador asignado a esta vulnerabilidad.

In Clash bis 0.20.1 für Windows wurde eine Schwachstelle ausgemacht. Sie wurde als kritisch eingestuft. Das betrifft eine unbekannte Funktionalität der Komponente Proxy Port. Durch das Manipulieren mit unbekannten Daten kann eine improper authentication-Schwachstelle ausgenutzt werden. Der Angriff kann über das Netzwerk angegangen werden. Der Exploit steht zur öffentlichen Verfügung. Als bestmögliche Massnahme werden Anpassungen an der Konfiguration empfohlen.

*Credits: rollingchair
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Attack Requirements
None
Privileges Required
None
User Interaction
None
System
Vulnerable | Subsequent
Confidentiality
Low
None
Integrity
Low
None
Availability
Low
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:Track
Exploitation
None
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-06-07 CVE Reserved
  • 2024-06-07 CVE Published
  • 2024-08-01 CVE Updated
  • 2024-08-01 First Exploit
  • 2024-12-17 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-287: Improper Authentication
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Clashforwindows
Search vendor "Clashforwindows"
 Clash
Search vendor "Clashforwindows" for product "Clash"
 >= 0.1.0 <= 0.20.1
Search vendor "Clashforwindows" for product "Clash" and version " >= 0.1.0 <= 0.20.1"
windows
Affected