CVE-2024-53846

mediumpriority · track · 0EPSS 0.003 · 18 %ileEURU

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.26% (18th) EPSS

CVSS 5.5 · medium

Is it mine?

7 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · fstec_bdu

EPSS · scored 2026-10-27

OTP is a set of Erlang libraries, which consists of the Erlang runtime system, a number of ready-to-use components mainly written in Erlang, and a set of design principles for Erlang programs. A regression was introduced into the ssl application of OTP starting at OTP-25.3.2.8, OTP-26.2, and OTP-27.0, resulting in a server or client verifying the peer when incorrect extended key usage is presented (i.e., a server will verify a client if they have server auth ext key usage and vice versa).

cvss

Technical severity, 0–10. One row per scoring source.

5.5

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.15.5mediumAV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · FSTEC (BDU) RU

v3.15.5mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · ENISA EU

v3.15.5mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:Lsecondary · security-advisories@github.comexploitability 1.3 · impact 3.7

v3.15.1mediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-295USCWE-295US

affected products (7)

Products and version ranges known to be affected.

erlang otp≤ 26.2, ≤ 26.2.5.6enisa_euvdEU
erlang otp≤ 27.0, ≤ 27.1.3enisa_euvdEU
erlang otp≤ 25.3.2.8, ≤ 25.3.2.16enisa_euvdEU
Ericsson-LG Enterprise Co., Ltd. Erlang≤ 27.1.3fstec_bduRU
Ericsson-LG Enterprise Co., Ltd. Erlang≤ 25.3.2.16fstec_bduRU
Ericsson-LG Enterprise Co., Ltd. Erlang≤ 26.2.5.6fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu NVD CVE.org MITRE

published 2024-12-05modified 2026-06-17

references (4)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan