Industrial
CVE-2026-24904
MEDIUM
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
4DescriptionGitHub Advisory
TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tls_listener.rs, TlsListener::listen() peeks 1024 bytes and calls extract_client_random(...). If parse_tls_plaintext fails (for example, a fragmented/partial ClientHello split across TCP writes), extract_client_random returns None. In rules.rs, RulesEngine::evaluate only evaluates client_random_prefix when client_random is Some(...). As a result, when extraction fails (client_random == None), any rule that relies on client_random_prefix matching is skipped and evaluation falls through to later rules. As an important semantics note: client_random_prefix is a match condition only. It does not mean "block non-matching prefixes" by itself. A rule with client_random_prefix = ... triggers its action only when the prefix matches (and the field is available to evaluate). Non-matches (or None) simply do not match that rule and continue to fall through. The vulnerability is fixed in version 0.9.115.
AnalysisAI
TrustTunnel VPN protocol versions prior to 0.9.115 contain a rule bypass vulnerability where fragmented TLS ClientHello messages fail to extract the client random value, causing the rules engine to skip client_random_prefix matching conditions and allow traffic that should be blocked. Public exploit code exists for this medium-severity network-accessible vulnerability affecting Industrial and TrustTunnel products. A patch is available for affected versions.
Technical ContextAI
Classified as CWE-284 (Improper Access Control). Affects Trusttunnel. TrustTunnel is an open-source VPN protocol with a rule bypass issue in versions prior to 0.9.115. In tls_listener.rs, TlsListener::listen() peeks 1024 bytes and calls extract_client_random(...). If parse_tls_plaintext fails (for example, a fragmented/partial ClientHello split across TCP writes), extract_client_random returns None. In rules.rs, RulesEngine::evaluate only evaluates client_random_prefix when client_random is Some(...). As a result, when extraction fails (`clie
RemediationAI
A vendor patch is available — apply it immediately. Fixed in version 0.9.115.. Restrict network access to the affected service where possible.
More in Industrial
View allKede Electronics IoT smart water meter monitoring platform v1.0 has a SQL injection allowing attackers to compromise the
bulk_extractor digital forensics tool starting from version 1.4 has a heap buffer overflow in its embedded unrar code th
RustCrypto CMOV before 0.4.4 emits non-constant-time assembly on ARM Cortex-M0/M0+/M1 targets. Cryptographic operations
dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to over
SQL injection in Koko Analytics for WordPress prior to version 2.1.3 allows unauthenticated attackers to inject maliciou
RustCrypto's SM2 elliptic curve implementation in versions 0.14.0-pre.0 and 0.14.0-rc.0 is vulnerable to denial-of-servi
free5GC SMF versions up to 1.4.1 crash when receiving malformed PFCP SessionReportRequest packets on UDP port 8805, allo
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the UDP/8805 inte
free5GC SMF versions up to 1.4.1 crash when processing malformed PFCP SessionReportRequest messages on the PFCP interfac
INIM Electronics Smartliving SmartLAN/G/SI <=6.x contains hard-coded credentials in its Linux distribution image that ca
Mailpit versions up to 1.28.2 contains a vulnerability that allows attackers to intercept sensitive data such as email c
Authentication bypass via path traversal in ZBT WE2001 router's check_token function. EPSS 0.69% — crafted requests bypa
Same weakness CWE-284 – Improper Access Control
View allShare
External POC / Exploit Code
Leaving vuln.today