CVE-2024-5264 Network Key Transfer with AES KHT vulnerability in Luna EFT
Administrative users can access backups via offline analysis due to weak cryptographic implementation in Thales Luna EFT.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-5264?
CVE-2024-5264 is a medium-severity vulnerability in Thales Luna EFT, published on 23 May 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis
Weakness: CWE-338
Which versions are affected by CVE-2024-5264?
It affects 1 product.
Products include Thalesgroup Luna Eft.
How do I fix CVE-2024-5264?
No fix has been published for CVE-2024-5264 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-5264 being exploited?
There is no known exploitation of CVE-2024-5264 in the wild and no public exploit code.
Sources
Also known as GHSA-hxp2-c3hq-rcq5.