PT-2026-2433 · Fabricators · Vanilla Os 2 Core

Published 2026-01-13 · Updated 2026-02-10 · CVE-2024-54855

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:H

Name of the Vulnerable Software and Affected Versions fabricators Ltd Vanilla OS 2 Core image version 1.1.0

Description The software contains static keys for the SSH service. This may allow attackers to execute a man-in-the-middle attack during connections with other hosts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2024-54855

GHSA-67PC-HQR2-G34H

Affected Products

Vanilla Os 2 Core

References · 7

• https://github.com/Vanilla-OS/core-image/security/advisories/GHSA-67pc-hqr2-g34h · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-54855 · Security Note
• https://osv.dev/vulnerability/CVE-2024-54855 · Vendor Advisory
• http://fabricators.com · Note
• https://twitter.com/CVEnew/status/2011112409134477738 · Twitter Post
• http://vanilla.com · Note
• https://t.me/cveNotify/151608 · Telegram Post