CVE-2024-54662 Missing authorization in n/a
Incorrect access control in Dante SOCKS server allows bypassing authentication when specific socksmethod configurations are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-54662?
CVE-2024-54662 is a critical missing authorization vulnerability in n/a, published on 17 Dec 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dante 1.4.0 through 1.4.3 (fixed in 1.4.4) has incorrect access control for some sockd.conf configurations involving socksmethod.
Weakness: CWE-863
Which versions are affected by CVE-2024-54662?
Linux distribution packages (3)
dante SUSE:Package Hub 15 SP6 | All versions | 1.4.4-bp156.4.3.1 |
dante openSUSE:Leap 15.6 | All versions | 1.4.4-bp156.4.3.1 |
dante openSUSE:Tumbleweed | All versions | 1.4.4-1.1 |
How do I fix CVE-2024-54662?
Upgrade to a fixed version.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-54662 being exploited?
There is no known exploitation of CVE-2024-54662 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-54662, GHSA-7w93-5823-j96v, UBUNTU-CVE-2024-54662, openSUSE-SU-2025:0030-1, openSUSE-SU-2025:15132-1.