Skip to main content

Discovery CVE-2024-23688

MEDIUM
Reusing a Nonce, Key Pair in Encryption (CWE-323)
2024-01-19 disclosure@vulncheck.com
Information Disclosure Discovery
5.3
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Lifecycle Timeline

1
CVE Published
Jan 19, 2024 - 22:15 nvd
MEDIUM 5.3

DescriptionNVD

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed.

AnalysisAI

Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-323. Consensys Discovery versions less than 0.4.5 uses the same AES/GCM nonce for the entire session. which should ideally be unique for every message. The node's private key isn't compromised, only the session key generated for specific peer communication is exposed. Affected products include: Consensys Discovery.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Discovery

View all
CVE-2023-48795 MEDIUM POC
5.9 Dec 18

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remot
CVE-2022-23463 CRITICAL POC
9.8 Sep 24

Nepxion Discovery is a solution for Spring Cloud. Rated critical severity (CVSS 9.8), this vulnerability is remotely exp
CVE-2025-13601 HIGH POC
7.7 Nov 26

Heap-based buffer overflow in GLib's g_escape_uri_string() function allows local attackers to achieve high-integrity and
CVE-2022-23464 HIGH POC
7.5 Sep 24

Nepxion Discovery is a solution for Spring Cloud. Rated high severity (CVSS 7.5), this vulnerability is remotely exploit
CVE-2018-11746 CRITICAL
9.8 Jul 03

In Puppet Discovery prior to 1.2.0, when running Discovery against Windows hosts, WinRM connections can fall back to usi
CVE-2024-12088 HIGH
7.5 Jan 14

Arbitrary file write outside the intended destination in rsync's client-side `--safe-links` handling allows a malicious

CVE-2020-1712 HIGH
7.8 Mar 31

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are

Same weakness CWE-323 – Reusing a Nonce, Key Pair in Encryption

View all
CVE-2026-59099 CRITICAL POC
9.3
CVE-2026-49952 CRITICAL POC
9.3
CVE-2017-13082 HIGH POC
8.1
CVE-2025-46632 MEDIUM POC
6.5
CVE-2023-28997 MEDIUM POC
6.5
CVE-2017-7902 CRITICAL
9.8
CVE-2026-12205 CRITICAL
9.1
CVE-2019-7593 CRITICAL
9.1

Same technique Information Disclosure

View all
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8
CVE-2023-7028 CRITICAL POC
10.0
CVE-2017-0213 HIGH POC
7.3

Share

CVE-2024-23688 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy