CVE•Published 2025-01-14•Modified 2026-10-13•1 article on news•6 live references•NVD data

CVE-2024-12085Samba · Rsync

Vulnerability data via NVD (ingested)

CVSS v3.1

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS percentile

Exploit Prediction Scoring System · top 5% of all CVEs

Weaknesses (CWE)

CWE-908Use of Uninitialized Resource

Description

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

Timeline

Published 2025-01-14

Modified 2026-10-13

External references

NVD MITRE Exploit-DB GitHub PoC trickest/cve VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2024-12085

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Samba Rsync"

All exposed Samba Rsync instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Rsync"

HTTP body or banner mentions "Rsync" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

Shodan report

vuln:CVE-2024-12085