CVE-2024-21649 HIGH

CVE-2024-21649: Remote code execution

Vendor Vantage6
Product vantage6
Weakness CWE-94 · Code injection
Published January 30, 2024
Last update May 29, 2025

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

The vantage6 technology enables to manage and deploy privacy enhancing technologies like Federated Learning (FL) and Multi-Party Computation (MPC). Prior to 4.2.0, authenticated users could inject code into algorithm environment variables, resulting in remote code execution. This vulnerability is patched in 4.2.0.

Key dates

02Disclosure timeline

January 30, 2024 CVE published
May 29, 2025 Record updated