CVE-2024-30170

CRITICAL

PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,

Affects 1 product across 1 vendor.

CVSS 3.19.1
EPSS0.6%
Percentile48th
PatchPatched
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, no integrity impact, full availability impact.
CWE Weakness Definitions
CWE-400: Uncontrolled Resource Consumption (DoS)

Software does not properly limit resource usage, allowing an attacker to exhaust CPU, memory, disk, or bandwidth.

Related Attack Patterns (CAPEC)
CAPEC-147 XML Ping of the Death
via CWE-400
CAPEC-492 Regular Expression Exponential Blowup
via CWE-400
CAPEC-227 Sustained Client Engagement
via CWE-400

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

PrivX versions prior to 34.0 are vulnerable to data exfiltration and denial of service attacks through the REST API.

BSID: BS-2024-GLOBAL-047739-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-30170?
PrivX versions prior to 34.0 are vulnerable to data exfiltration and denial of service attacks through the REST API.
What is the CVSS score for CVE-2024-30170?
CVE-2024-30170 has CVSS 9.1 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS: 0.6%.
Is CVE-2024-30170 actively exploited?
No confirmed active exploitation of CVE-2024-30170 as of 2026-05-30.
How do I remediate CVE-2024-30170?
Priority: IMMEDIATE. Advisory: https://info.ssh.com/improper-input-validation-faq PSIRT: [email protected]
What systems are affected by CVE-2024-30170?
CVE-2024-30170 affects Ssh Privx.
Vulnerability Details
CVE IDCVE-2024-30170
BSIDBS-2024-GLOBAL-047739-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Published2024-08-06
Last Modified2024-08-12
ICS Relevance15%
Weakness (CWE)
Uncontrolled Resource Consumption (DoS)
SourceNVD
Official Description

PrivX before 34.0 allows data exfiltration and denial of service via the REST API. This is fixed in minor versions 33.1, 32.3, 31.3, and later, and in major version 34.0 and later,

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the vulnerability by sending malicious requests to the REST API, leading to unauthorized data access and potential service disruption.

Exploitation Likelihood: HIGH

Affected Products
VendorProductAffected Versions
Ssh Privx 33.0 ≥ 22.0, < 31.3 ≥ 32.0, < 32.3
Remediation
View Vendor Advisory →

Remediation Priority: IMMEDIATE

Vendor PSIRT: [email protected]
Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 800 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash0fe7f3adc4f782bc092837cd762dbec017f97dcd571cf39d634c7e23e4db048e76a51f21823ada44b2a087a0c6a72392962d0b3277ad2d2ae78df6907d9b42ff
Related CVEs affecting Ssh
CVE-1999-0248 10.0 A race condition in the authentication agent mechanism of sshd 1.2.17 allows ... CVE-2002-1645 10.0 Buffer overflow in the URL catcher feature for SSH Secure Shell for Workstati... CVE-2001-0144 10.0 CORE SDI SSH1 CRC-32 compensation attack detector allows remote attackers to ... CVE-2012-5975 9.3 The SSH USERAUTH CHANGE REQUEST feature in SSH Tectia Server 6.0.4 through 6.... CVE-2021-27891 8.8 SSH Tectia Client and Server before 6.4.19 on Windows have weak key generatio...
View all Ssh CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.1 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →