CVE-2024-26306

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26306
iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption, as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

5.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc Third Party Advisory
https://github.com/esnet/iperf/releases/tag/3.17 Release Notes
https://www.insyde.com/security-pledge/SA-2024005 Third Party Advisory
https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc Third Party Advisory
https://github.com/esnet/iperf/releases/tag/3.17 Release Notes
https://security.netapp.com/advisory/ntap-20250228-0007/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:es:iperf3:*:*:*:*:*:*:*:*

Configuration 2 (hide)

AND
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
History

26 Sep 2025, 19:19

Type Values Removed Values Added
CPE cpe:2.3:a:es:iperf3:*:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*
First Time Netapp
Netapp hci Compute Node
Es
Netapp bootstrap Os
Es iperf3
References () https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc - () https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc - Third Party Advisory
References () https://github.com/esnet/iperf/releases/tag/3.17 - () https://github.com/esnet/iperf/releases/tag/3.17 - Release Notes
References () https://www.insyde.com/security-pledge/SA-2024005 - () https://www.insyde.com/security-pledge/SA-2024005 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20250228-0007/ - () https://security.netapp.com/advisory/ntap-20250228-0007/ - Third Party Advisory

28 Feb 2025, 13:15

Type Values Removed Values Added
References
  • () https://security.netapp.com/advisory/ntap-20250228-0007/ -

10 Feb 2025, 23:15

Type Values Removed Values Added
CWE CWE-385
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.9

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc - () https://downloads.es.net/pub/iperf/esnet-secadv-2024-0001.txt.asc -
References () https://github.com/esnet/iperf/releases/tag/3.17 - () https://github.com/esnet/iperf/releases/tag/3.17 -

20 Aug 2024, 05:15

Type Values Removed Values Added
References
  • () https://www.insyde.com/security-pledge/SA-2024005 -
Summary
  • (es) iPerf3 anterior a 3.17, cuando se usa con OpenSSL anterior a 3.2.0 como servidor con autenticación RSA, permite un canal lateral de temporización en las operaciones de descifrado RSA. Este canal lateral podría ser suficiente para que un atacante recupere el texto sin formato de las credenciales. Requiere que el atacante envíe una gran cantidad de mensajes para descifrarlos, como se describe en "Everlasting ROBOT: the Marvin Attack" de Hubert Kario.

14 May 2024, 15:08

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 15:08

Updated : 2025-09-26 19:19

NVD link : CVE-2024-26306

Mitre link : CVE-2024-26306

CVE.ORG link : CVE-2024-26306

JSON object : View

Products Affected

netapp

  • hci_compute_node
  • bootstrap_os

es

  • iperf3
CWE
CWE-385

Covert Timing Channel