Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2024-26306

20
FAUCET Score

CVE-2024-26306 is a timing side-channel vulnerability in iPerf3 versions prior to 3.17, when configured as a server with RSA authentication and using OpenSSL before 3.2.0. This flaw affects products such as es iperf3 and netapp iperf3, potentially allowing an attacker to recover credential plaintext. Rated Medium (CVSS 5.9), the vulnerability requires high attack complexity (AC:H) but no user interaction (UI:N), with a network attack vector (AV:N) leading to high confidentiality impact (C:H). Currently, there is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.

Impacted Technologies

VendorProductVersion(s)CPE
< 3.17CPE matchmatch criteria
cpe:2.3:a:es:iperf3:*:*:*:*:*:*:*:*
Range not provided by sourceCPE matchmatch criteria
cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

5.9MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.10%
Probability of exploitation in next 30 days
EPSS Percentile
62.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0110 is in the 24th percentile among its peer group of 19,956 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (14)

microsoftpatch availablevia msrc
Product: azl3 iperf3 3.16-1 on Azure Linux 3.0Fixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 3.17-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: azl3 iperf3 3.17.1-1 on Azure Linux 3.0Fixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 3.17-1
microsoftpatch availablevia msrc
Product: 17339-16823Fixed in: 3.17-1
microsoftpatch availablevia msrc
Product: 19985-17086Fixed in: 3.17-1
microsoftpatch availablevia msrc
Product: 17743-17084Fixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: 20000-17084Fixed in: 3.17.1-1
microsoftpatch availablevia msrc
Product: cbl2 iperf3 3.17-1 on CBL Mariner 2.0Fixed in: 3.17-1
microsoftpatch availablevia msrc
Product: cbl2 iperf3 3.14-2 on CBL Mariner 2.0Fixed in: 3.17-1
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: iperf3-0:3.5-10.el8_10
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: iperf3-0:3.9-13.el9
View patch

Vendor Advisories (3)

microsoft2024-Sep/CVE-2024-26306

CVE-2024-26306

Sep 10, 2024
redhatCVE-2024-26306Moderate

iperf3: vulnerable to marvin attack if the authentication option is used

May 15, 2024
microsoft2024-May/CVE-2024-26306Moderate

iPerf3 before 3.17 when used with OpenSSL before 3.2.0 as a server with RSA authentication allows a timing side channel in RSA decryption operations. This side channel could be sufficient for an attacker to recover credential plaintext. It requires the attacker to send a large number of messages for decryption as described in "Everlasting ROBOT: the Marvin Attack" by Hubert Kario.

May 14, 2024

References

lists.debian.org / debian-lts-announce/2025/01/msg00027.html
security.netapp.com / advisory/ntap-20250228-0007
Third Party Advisory
downloads.es.net / pub/iperf/esnet-secadv-2024-0001.txt.asc
Third Party Advisory
github.com / esnet/iperf/releases/tag/3.17
Release Notes
insyde.com / security-pledge/SA-2024005
Third Party Advisory