{"id":"CVE-2024-6107","aliases":["EUVD-2024-54803","GHSA-525h-hfxr-w785","UBUNTU-CVE-2024-6107"],"status":"published","title":"Due to insufficient verification, an attacker could use a malicious client to bypass...","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","severity":{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00418,"percentile":0.36633,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2025-07-21T08:52:56Z","modified":"2026-06-17T08:17:18Z","affected":[{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"maas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.3+bzr4053-0ubuntu1","1.9.0+bzr4533-0ubuntu1","1.10.0+bzr4578-0ubuntu2","2.0.0~alpha1+bzr4736-0ubuntu1","2.0.0~alpha2+bzr4776-0ubuntu1","2.0.0~alpha3+bzr4810-0ubuntu1","2.0.0~alpha4+bzr4843-0ubuntu1","2.0.0~beta1+bzr4873-0ubuntu1","2.0.0~beta1+bzr4873-0ubuntu2","2.0.0~beta1+bzr4873-0ubuntu3","2.0.0~beta2+bzr4920-0ubuntu1","2.0.0~beta2+bzr4920-0ubuntu2","2.0.0~beta3+bzr4941-0ubuntu1","2.0.0~rc2+bzr5156-0ubuntu1~16.04.1","2.0.0~rc2+bzr5156-0ubuntu1~16.04.2","2.0.0+bzr5189-0ubuntu1~16.04.1","2.1.1+bzr5544-0ubuntu1~16.04.1","2.1.3+bzr5573-0ubuntu1~16.04.1","2.1.5+bzr5596-0ubuntu1~16.04.1","2.2.0+bzr6054-0ubuntu2~16.04.1","2.2.2-6099-g8751f91-0ubuntu1~16.04.1","2.3.0-6434-gd354690-0ubuntu1~16.04.1","2.3.5-6511-gf466fdb-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"maas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0~beta2-6327-gdd05aa2-0ubuntu1","2.3.0-6434-gd354690-0ubuntu1","2.4.0~alpha2-6717-gffaddd526-0ubuntu1~18.04.1","2.4.0~beta1-6799-g391e5f16d-0ubuntu1","2.4.0~beta2-6865-gec43e47e6-0ubuntu1","2.4.0-6981-g011e51b7a-0ubuntu1~18.04.1","2.4.2-7034-g2f5deb8b8-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"maas","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.0-7802-g59416a869-0ubuntu1","1:0.1","1:0.2","1:0.3","1:0.4","1:0.5","1:0.6","1:0.7"]}],"products":[{"vendor":"canonical","product":"maas"},{"vendor":"canonical","product":"metal_as_a_service"},{"vendor":"ubuntu","product":"maas"}],"references":[{"url":"https://bugs.launchpad.net/maas/+bug/2069094","tags":["Exploit","Issue Tracking","Patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6107"},{"url":"https://github.com/advisories/GHSA-525h-hfxr-w785"},{"url":"https://ubuntu.com/security/CVE-2024-6107","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6107","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-6107","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","status":"published","published":"2025-07-21T08:52:56.608Z","modified":"2025-07-21T17:07:16.633Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-54803","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","status":"published","published":"2025-07-21T08:52:56Z","modified":"2025-07-21T17:07:16Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:06.121511Z"}],"ghsa":[{"id":"GHSA-525h-hfxr-w785","title":"Due to insufficient verification, an attacker could use a malicious client to bypass...","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","status":"published","published":"2025-07-21T09:33:27Z","modified":"2025-07-21T09:33:33Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:03:04.468862Z"}],"nvd":[{"id":"CVE-2024-6107","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","status":"published","published":"2025-07-21T09:15:23.97Z","modified":"2026-06-17T08:17:18.007Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"UBUNTU-CVE-2024-6107","description":"Due to insufficient verification, an attacker could use a malicious client to bypass authentication checks and run RPC commands in a region. This has been addressed in MAAS and updated in the corresponding snaps.","status":"published","published":"2025-07-23T00:00:00Z","modified":"2025-10-24T05:06:45Z","cvss":[{"version":"3.1","score":9.6,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:H","level":"critical"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:55:18.664792Z"}]}}