Skip to content
Fencer Vulns
critical 9.8

CVE-2024-2056 in the critical feed json

Artica Proxy Loopback Services Remotely Accessible Unauthenticated

published 2024-03-05 2 y ago modified 2026-06-17 4 mo ago also GO-2024-2612 , EUVD-2024-27021

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
16.7%
EPSS 16.7% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

Services that are running and bound to the loopback interface on the Artica Proxy are accessible through the proxy service. In particular, the "tailon" service is running, running as the root user, is bound to the loopback interface, and is listening on TCP port 7050. Security issues associated with exposing this network service are documented at gvalkov's 'tailon' GitHub repo. Using the tailon service, the contents of any file on the Artica Proxy can be viewed.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

16.71% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • korelogic.com https://korelogic.com/Resources/Advisories/KL-001-2024-004.txt referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2024/Mar/14 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/gvalkov/tailon
all versions
 no fix listed

Affected products

  • Artica Tech Artica Proxy
  • articatech artica_proxy

Classification

Weakness
  • CWE-288 Authentication Bypass Using an Alternate Path or Channel
  • CWE-552 Files or Directories Accessible to External Parties

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.