Welcome to abdal-anydesk-remote-ip-detector Discussions!

[ebrasha]

👋 Welcome!

We’re using Discussions as a place to connect with other members of our community. We hope that you:

• Ask questions you’re wondering about.
• Share ideas.
• Engage with other community members.
• Welcome others and are open-minded. Remember that this is a community we
  build together 💪.

To get started, comment below with an introduction of yourself and tell us about what you do with this community.

[baramundi-ahaugk]

Isn't the CVSS closer to 5.3 (medium) than to 7.5 (high)?

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

[ebrasha]

https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Dear Alexander,

Your point about company IPs not being personal data under GDPR and their availability through simpler methods is factually incorrect and misrepresents the nature of this vulnerability. Let me clarify:

GDPR and IP Addresses:

GDPR explicitly recognizes IP addresses as personal data, regardless of whether they belong to individuals or companies, when they can be linked to specific devices or users. This vulnerability exposes both public and private IPs without user consent or interaction, which constitutes a clear breach of confidentiality under GDPR standards.

Ease of Access Is Irrelevant:

The fact that IPs might be obtainable through other means does not diminish the severity of this vulnerability. CVSS scoring is based on the nature of the vulnerability itself, not on whether alternative methods exist to achieve a similar outcome. Here, the system actively leaks IP addresses due to flawed design, without user knowledge or consent, making it inherently impactful.

Real-World Implications:

Exposing private IP addresses within a local network can lead to serious exploitation opportunities, including lateral movement, unauthorized access, and targeted attacks. The disclosure of public IPs allows for geo-tracking, targeted DDoS attacks, and reconnaissance, which elevate the severity of the issue far beyond "Low."

Authority of NIST and MITRE:

The CVSS score was determined and reviewed by globally recognized authorities such as NIST and MITRE, who are widely respected for their objectivity and expertise. Disregarding their assessment without presenting substantial evidence undermines the collaborative nature of vulnerability reporting and resolution.

Finally, while AnyDesk’s input is valuable, the scoring of vulnerabilities is based on objective criteria set by CVSS standards, not the subjective opinions of affected vendors.

I strongly encourage you to revisit the CVSS guidelines and consider the factual basis for the scoring rather than personal assumptions.

Best regards,
Ebrahim Shafiei (EbraSha)
CVE Reporter, CVE-2024-52940

[baramundi-ahaugk]

With all due respect to NIST and MITRE, the response times leave a lot to be desired.
This vulnerability is still awaiting analysis and the base score given is based on the personal assessment of the reporter.

I am really curious to see whether your assumptions will prove correct, or whether the score will be lowered after a detailed professional analysis by manufacturers and authorities.

[ebrasha]

Your approach to questioning the CVSS score of CVE-2024-52940 solely based on the fact that the vulnerability is "awaiting analysis" is flawed. Allow me to explain with an example to illustrate why this reasoning is incorrect.

If we consider CVE-2024-28000, the vulnerability in LiteSpeed Cache that allows privilege escalation, it is also marked as "awaiting analysis." Despite this, it has been assigned a base score of 9.8 (Critical) by a credible CNA (Patchstack). Following your logic, one could claim this score is "invalid" or "incorrect" simply because the NVD analysis has not been completed yet. However, such an assertion disregards the rigorous assessment performed by recognized experts in the field.
I have attached the image below this message for your reference to see the example I mentioned regarding CVE-2024-28000.

Similarly, for CVE-2024-52940, the initial CVSS score has been calculated based on well-defined standards and methodologies, which include the CVSS calculator. Just as CVE-2024-28000 reflects its severity independently of the NVD's analysis status, the same holds true for CVE-2024-52940.

What truly matters in these cases is the factual basis for the score:

Does the vulnerability compromise confidentiality, integrity, or availability?

Is the CVSS vector string accurately defined based on the vulnerability's real-world impact?

For CVE-2024-52940, the confidentiality impact is correctly classified as "High" because it exposes sensitive data (IP addresses) without user consent. Dismissing this severity based on the analysis status is not valid.

Let us focus on the technical merits and documented impacts of the vulnerabilities rather than subjective assumptions.

Best regards,
Ebrahim Shafiei (EbraSha)
CVE Reporter, CVE-2024-52940

[baramundi-ahaugk]

I understand your point of view at this point and also respect your persistence. Especially with regard to the rating, I can understand that you rate it as highly as possible, as this is associated with higher reputaion.
From a professional perspective, however, I cannot agree with you.

Let's wait and see how the final assessment turns out.

[ebrasha]

🙏Thank you for sharing your perspective.
Yours sincerely,
Ebrahim Shafiei (EbraSha)
CVE Reporter, CVE-2024-52940