VulnSocial

CVE-2024-54143Active Exploitation

LOWCVSS 9.3 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Prioritize remediation for affected systems immediately
  • Assume compromise if assets are exposed
  • Track advisory updates for patch or workaround availability

Recommended action window: Immediate (within 24h)

NVD description

openwrt/asu is an image on demand server for OpenWrt based distributions. The request hashing mechanism truncates SHA-256 hashes to only 12 characters. This significantly reduces entropy, making it feasible for an attacker to generate collisions. By exploiting this, a previously built malicious image can be served in place of a legitimate one, allowing the attacker to "poison" the artifact cache and deliver compromised images to unsuspecting users. This can be combined with other attacks, such as a command injection in Imagebuilder that allows malicious users to inject arbitrary commands into the build process, resulting in the production of malicious firmware images signed with the legitimate build key. This has been patched with 920c8a1.

Back to dashboard
3.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-328

Priority

LOW

Exploitation

ACTIVE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • Active exploitation appears in 1 classified signals
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Active exploitation reported across 1 signal
  • Technical details provided in 2 signals
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 1 mentions (2026-09-09); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-09: 1Mentions · 2026-10-19: 1Active Exploitation · 2026-09-09: 1Technical Details · 2026-09-09: 1Technical Details · 2026-10-19: 109-0910-19
Signal classification2 categories
Active Exploitation
150.0%
Disclosure
150.0%
Referenced assets2 URLs
Classification over time
DateTotalLabels
2026-09-091
Active Exploitation1
2026-10-191
Disclosure1
Full discourse2 posts
  • DailyCVE@dailycve
    Disclosure

    🔴 OpenWrt Attended SysUpgrade Hash Collision #CVE-2024-54143 Critical - Just Updated -DC-Oct2026-3376 https://dailycve.com/openwrt-attended-sysupgrade-hash-collision-cve-2024-54143-critical-just-updated-dc-oct2026-3376/

    Post summary

    The text announces CVE-2024-54143, a critical hash collision vulnerability in OpenWrt Attended SysUpgrade, providing basic technical details (vulnerability type and severity) but lacking explicit PoC, exploit, patch, or active exploitation information. The brevity and headline-only nature of the post lowers confidence.

    0000036
    243 followersView on X
  • Aviatrix Threat Research Center@aviatrixtrc
    Active Exploitation

    TRC analysis shows attackers exploited CVE-2024-54143 in Lean theorem prover to fabricate mathematical proofs, including a false proof of Fermat's Last Theorem. This supply chain vulnerability demonstrates how compromised verification tools can pivot through development environments. Runtime segmentation helps contain such CI/CD pipeline breaches. #SupplyChainSecurity 🔗 Full breakdown: https://aviatrix.ai/threat-research-center/lean-theorem-prover-vulnerability-cve-2026-fermat-proof-exploit

    Post summary

    Attackers exploited CVE‑2024‑54143 in the Lean theorem prover to forge false mathematical proofs, illustrating an active supply‑chain attack scenario. No patch, PoC, or workaround is detailed in the brief.

    0000037
    2.0K followersView on X

Explore more

Back to dashboard