Icewhale develops CasaOS, a lightweight operating system and management platform for home and small-business network-attached storage and edge computing devices. The vendor's vulnerability profile centers on authentication and information-exposure weaknesses across its gateway and user-service components, with a notable share of disclosures reaching critical severity and a tendency toward public exploit availability. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Icewhale over time
Signals from CVEs in this vendor scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-37266CRITICAL CasaOS is an open-source Personal Cloud system. Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication and execute arbitrary com | Jul 17, 2023 | 9.8 | 45 | NO | YES |
CVE-2023-37265CRITICAL CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification an unauthenticated attackers can execute arbitrary commands as `root` on CasaOS instances. | Jul 17, 2023 | 9.8 | 45 | NO | YES |
CVE-2022-24193CRITICAL CasaOS before v0.2.7 was discovered to contain a command injection vulnerability. | Mar 10, 2022 | 9.8 | 32 | NO | NO |
CVE-2024-24767CRITICAL CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, CasaOS doesn't defend against password brute force at | Mar 6, 2024 | 9.8 | 25 | NO | NO |
CVE-2024-24765CRITICAL CasaOS-UserService provides user management functionalities to CasaOS. Prior to version 0.4.7, path filtering of the URL for user avatar image files was not strict, making it possi | Mar 6, 2024 | 9.8 | 25 | NO | NO |
CVE-2023-37469HIGH CasaOS is an open-source personal cloud system. Prior to version 0.4.4, if an authenticated user using CasaOS is able to successfully connect to a controlled SMB server, they are a | Aug 24, 2023 | 8.8 | 23 | NO | NO |
CVE-2024-28232HIGH Go package IceWhaleTech/CasaOS-UserService provides user management functionalities to CasaOS. The Casa OS Login page has disclosed the username enumeration vulnerability in the lo | Apr 1, 2024 | 7.5 | 22 | NO | NO |
CVE-2025-34171MEDIUM CasaOS versions up to and including 0.4.15 expose multiple unauthenticated endpoints that allow remote attackers to retrieve sensitive configuration files and system debug informat | Jan 2, 2026 | 5.3 | 20 | NO | NO |
CVE-2024-24766HIGH CasaOS-UserService provides user management functionalities to CasaOS. Starting in version 0.4.4.3 and prior to version 0.4.7, the Casa OS Login page disclosed the username enumera | Mar 6, 2024 | 7.5 | 20 | NO | NO |
Signals from CVEs in this vendor scope (9 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Icewhale.
Media articles that mention a CVE ID that affects a product developed by Icewhale — matched by CVE ID, not by vendor name.