CVE-2024-10081 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🏢 **Vendor**: Ericsson. 📦 **Product**: CodeChecker (Clang Static Analyzer/Tidy tool). ⚠️ **Affected Versions**: **6.24.1 and earlier**. 📅 **Published**: Nov 6, 2024.

Q: Is exploitation threshold high? (Auth/Config)

🔓 **Auth Requirement**: **None** (PR:N). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). 🚀 **Threshold**: **Very Low**. No user interaction needed (UI:N). Easy to exploit remotely.

Q: Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade to **CodeChecker version > 6.24.1**. 📢 **Advisory**: Refer to Ericsson's GitHub Security Advisory. 🔄 **Action**: Immediate patching is recommended to close the authentication bypass hole.

Updated May 08, 2026 CVSS 10.0 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: CodeChecker has an **Authentication Bypass** flaw.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE-288**: Authentication Bypass. 🔍 **Flaw**: The system fails to properly verify credentials when the API URL ends with specific keywords like **Authentication**, **Configuration**, or **ServerInfo**.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🏢 **Vendor**: Ericsson. 📦 **Product**: CodeChecker (Clang Static Analyzer/Tidy tool). ⚠️ **Affected Versions**: **6.24.1 and earlier**. 📅 **Published**: Nov 6, 2024.

Q4What can hackers do? (Privileges/Data)

👑 **Privileges**: Gains **Superuser** access. 📂 **Data/Actions**: Can **add, edit, and remove products**. 🌐 **Scope**: Access to all API endpoints *except* the Authentication endpoint itself.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

🔓 **Auth Requirement**: **None** (PR:N). 🌐 **Access**: Network accessible (AV:N). 🎯 **Complexity**: Low (AC:L). 🚀 **Threshold**: **Very Low**. No user interaction needed (UI:N). Easy to exploit remotely.

Q6Is there a public Exp? (PoC/Wild Exploitation)

📜 **PoC Available**: Yes. 🔗 **Source**: Nuclei templates (ProjectDiscovery). 🧪 **Status**: Publicly known via GitHub Advisory (GHSA-f3f8-vx3w-hp5q).…

Read full answer (login)

Q7How to self-check? (Features/Scanning)

🔍 **Check**: Scan for CodeChecker instances. 🎯 **Test**: Send requests to URLs ending in `/Authentication`, `/Configuration`, or `/ServerInfo`.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛠️ **Fix**: Upgrade to **CodeChecker version > 6.24.1**. 📢 **Advisory**: Refer to Ericsson's GitHub Security Advisory. 🔄 **Action**: Immediate patching is recommended to close the authentication bypass hole.

Q9What if no patch? (Workaround)

🚧 **Workaround**: If patching is delayed, **restrict network access** to the API endpoints. 🛑 **Firewall**: Block external access to `/Configuration` and `/ServerInfo` paths.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

🔥 **Priority**: **HIGH**. 🚨 **Urgency**: CVSS Score indicates Critical impact on Confidentiality and Integrity. ⏳ **Action**: Patch immediately.…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) Ericsson CWE-288