CVE-2024-36066

CVE-2024-36066 affects the CMP CLI client in KeyFactor EJBCA versions prior to 8.3.1. The vulnerability stems from the client's use of a 6-octet salt for password-based MAC, which is non-compliant with RFC 4211's requirement for at least 8 octets, making it susceptible to man-in-the-middle attacks. This is a low-severity vulnerability (CVSS 3.1) with a network attack vector and high attack complexity, potentially leading to a limited compromise of confidentiality. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.