CVE-2024-12086

6.1 · MEDIUM

Published Jan 14, 2025 samba CWE-390 EPSS 1.83% (77th pctl) CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N

Overview

CVE-2024-12086 is a medium-severity vulnerability affecting samba rsync. It was published on January 14, 2025 and has a CVSS 3.1 base score of 6.1 (MEDIUM).

This vulnerability has a CVSS 3.1 base score of 6.1, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

Technical Description

A flaw was found in rsync. It could allow a server to enumerate the contents of an arbitrary file from the client's machine. This issue occurs when files are being copied from a client to a server. During this process, the rsync server will send checksums of local data to the client to compare with in order to determine what data needs to be sent to the server. By sending specially constructed checksum values for arbitrary files, an attacker may be able to reconstruct the data of those files byte-by-byte based on the responses from the client.

Remediation

Check the references section for vendor advisories and patches from samba. Update rsync to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

Vendor	Product	Versions	Status
samba	rsync	0	Affected
nixos	nixos	>= 0, < 24.11	Affected
tritondatacenter	smartos	>= 0, < 20250123	Affected

References

Ref access.redhat.com/errata/RHBA-2025:6470 Ref access.redhat.com/errata/RHSA-2026:19368 Ref access.redhat.com/errata/RHSA-2026:20603 Ref access.redhat.com/errata/RHSA-2026:29197 Ref access.redhat.com/security/cve/CVE-2024-12086 Ref bugzilla.redhat.com/show_bug.cgi?id=2330577 Ref kb.cert.org/vuls/id/952657 Ref lists.debian.org/debian-lts-announce/2025/01/msg00008.html Ref security.netapp.com/advisory/ntap-20250131-0002/ Ref www.kb.cert.org/vuls/id/952657

Frequently Asked Questions

What is CVE-2024-12086?

CVE-2024-12086 is a medium-severity vulnerability affecting samba rsync. It was published on January 14, 2025 and has a CVSS 3.1 base score of 6.1 (MEDIUM).

How severe is CVE-2024-12086?

This vulnerability has a CVSS 3.1 base score of 6.1, rated MEDIUM. It can be exploited remotely over the network. No authentication or special privileges are required for exploitation.

How do I fix or remediate CVE-2024-12086?

How can CyberStrike help with CVE-2024-12086?

CyberStrike's AI-powered security agents can automatically detect CVE-2024-12086 across your infrastructure using autonomous pentesting, DAST scanning, and HackBrowser. The platform continuously monitors for known vulnerabilities and provides actionable remediation guidance prioritized by real-world exploitability.

How CyberStrike Helps

Autonomous Discovery

AI agents map your attack surface to find vulnerabilities like this one.

Continuous Pentesting

Automated penetration testing that runs continuously, not just quarterly.

Code Review

AI-driven PR review catches vulnerable dependencies before they ship.

HackBrowser

Browser-based exploitation validates findings with real proof-of-concept.

Related MEDIUM CVEs from 2024

View all →

6.9

CVE-2023-3726

OCSInventory allow stored email template with special characters that lead to a Stored cross-site Sc

6.9

CVE-2023-51719