Read the docs
TI-2024-06102 Aliases CVE-2024-6580GHSA-v7mh-qpq8-5g5p

/n software IPWorks SSH insufficient file access verification

Priority LOW 11CWE-1390Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

The /n software IPWorks SSH library SFTPServer component can be induced to make unintended filesystem or network path requests when loading a SSH public key or certificate. To be exploitable, an application calling the SFTPServer component must grant user access without verifying the SSH public key or certificate (which would most likely be a separate vulnerability in the calling application). IPWorks SSH versions 22.0.8945 and 24.0.8945 were released to address this condition by blocking all filesystem and network path requests for SSH public keys or certificates.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00139 3rd percentileScored 2026-11-07
Fix Fixed IPWorks SSH SFTPServer (/n software): 22.0.8945, 24.0.8945

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
/n softwareIPWorks SSH SFTPServerbefore 22.0.8945; before 24.0.894522.0.8945, 24.0.8945Patch availableCNA
  • IPWorks SSH SFTPServer Vendor/n software Affected before 22.0.8945; before 24.0.8945 Fixed in 22.0.8945, 24.0.8945 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nsoftware:ipworks_ssh:22.0.8945:*:*:*:*:.net:*:*22.0.8945Vulnerable/n software
cpe:2.3:a:nsoftware:ipworks_ssh:24.0.8945:*:*:*:*:.net:*:*24.0.8945Vulnerable/n software
  • cpe:2.3:a:nsoftware:ipworks_ssh:22.0.8945:*:*:*:*:.net:*:* Versions 22.0.8945 Vulnerable ·/n software
  • cpe:2.3:a:nsoftware:ipworks_ssh:24.0.8945:*:*:*:*:.net:*:* Versions 24.0.8945 Vulnerable ·/n software

Remediation

  • Fix · CNA IPWorks SSH SFTPServer (/n software) Fixed in 22.0.8945, 24.0.8945

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6580
  2. 2026-10-03 Alias added: GHSA-v7mh-qpq8-5g5p

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences