CVE-2024-5264

Network Key Transfer with AES KHT vulnerability in Luna EFT

Medium5.9EPSS 0.36%

Published: 23 May 2024
Updated: 1 Aug 2024
Reserved: 23 May 2024
Assigned by: THA-PSIRT

Description

Network Transfer with AES KHT in Thales Luna EFT 2.1 and above allows a user with administrative console access to access backups taken via offline analysis

Scores

CVSS scores of CVE-2024-5264, by who scored it
Scored by	CVSS	Score	Vector
THA-PSIRTCNA (assigner)	3.1	Medium5.9	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

EPSS (exploitation in 30 days): 0.36% · top 69% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: no · Technical impact: total

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (opens in a new tab)All about CWE-338 and its CVEs

Affected products

Thales · Luna EFT
- affected 2.1.0

What to do

Workaround: Disable functionality in the console - see linked bulletin

References (1)

https://supportportal.thalesgroup.com/csm?id=kb_article_view&sys_kb_id=50da3cd9c302c218204e2a6ce00131b9&sysparm_article=KB0028531 (opens in a new tab)x_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2024-5264](https://trackcve.app/badge/CVE-2024-5264.svg)](https://trackcve.app/cve/CVE-2024-5264)

Record last updated 1 Aug 2024, 21:11 UTC.