Dashboard / CVE-2024-1488

CVE-2024-1488

HIGH
MEDIUM Priority: 0.03 BB Relevance: 51/100
Published: 2024-02-15 Modified: 2026-11-04 First seen: 2026-11-04 Status: active

Attack Surface

Low Complexity No Auth No Interaction Integ. Impact

CVSS Vector Breakdown

AV: Local
AC: Low
PR: None
UI: None
S: Unchanged
C: Low
I: High
A: High

Description

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

Weakness Classification (1)

Affected Software (52)

VendorProductVersion
— — 1.16.2
fedoraproject unbound < 1.19.1-2.fc40
redhat codeready_linux_builder 9.0
redhat codeready_linux_builder_eus 9.2
redhat codeready_linux_builder_eus 9.4
redhat codeready_linux_builder_eus_for_power_little_endian 9.0_ppc64le
redhat codeready_linux_builder_eus_for_power_little_endian 9.2_ppc64le
redhat codeready_linux_builder_for_arm64 9.0_aarch64
redhat codeready_linux_builder_for_arm64 9.2_aarch64
redhat codeready_linux_builder_for_arm64_eus 9.4_aarch64
redhat codeready_linux_builder_for_ibm_z_systems 9.0_s390x
redhat codeready_linux_builder_for_ibm_z_systems 9.2_s390x
redhat codeready_linux_builder_for_ibm_z_systems_eus 9.4_s390x
redhat enterprise_linux 8.0
redhat enterprise_linux 9.0
redhat enterprise_linux_eus 8.6
redhat enterprise_linux_eus 8.8
redhat enterprise_linux_eus 9.2
redhat enterprise_linux_eus 9.4
redhat enterprise_linux_for_arm_64 8.0_aarch64
redhat enterprise_linux_for_arm_64 9.0_aarch64
redhat enterprise_linux_for_arm_64 9.2_aarch64
redhat enterprise_linux_for_arm_64_eus 8.6_aarch64
redhat enterprise_linux_for_arm_64_eus 8.8_aarch64
redhat enterprise_linux_for_arm_64_eus 9.4_aarch64
redhat enterprise_linux_for_ibm_z_systems 8.0_s390x
redhat enterprise_linux_for_ibm_z_systems 9.0_s390x
redhat enterprise_linux_for_ibm_z_systems 9.2_s390x
redhat enterprise_linux_for_ibm_z_systems_eus 8.6_s390x
redhat enterprise_linux_for_ibm_z_systems_eus 8.8_s390x
Showing 30 of 52 entries

References & Advisories (11)

Bug Bounty Relevance

51 / 100
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

8.0 / 10.0 v3.1
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

EPSS — Exploitation Probability

0.32%
Raw Score 0.003210
Percentile 25.2%
Date 2026-11-05

EPSS Trend

2026-11-05
0.00321
2026-11-04
0.00321

Intelligence Sources

mitre ref →
nvd ref →

External Links