CVE-2024-2873: Wolfssh

Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days.

A vulnerability was found in wolfSSH's server-side state machine before versions 1.4.17. A malicious client could create channels without first performing user authentication, resulting in unauthorized access.

Affected products

• Wolfssh Wolfssh: before 1.4.17 (fixed in 1.4.17)

Published 2024-03-25. Last modified 2026-06-17.