CVE-2024-2056

The 'tailon' service is running as root and listening on TCP port 7050 assigned to the loopback interface, which would normally restrict access to local processes only. However, the proxy mechanism in Artica Proxy incorrectly exposes loopback-associated services to remote clients, effectively bypassing this security control. The vulnerability is classified as CWE-288 (authentication bypass by alternative path) and CWE-552 (file access by external service). According to the documentation of the 'tailon' repository on GitHub, exposure of this service is associated with serious security issues.

An attacker without any authentication can read the contents of any file on the Artica Proxy device, including potentially files containing credentials, private keys, and other sensitive configuration information. Full root privileges of the 'tailon' service increase the risk of complete device takeover.

Apply patches available from the manufacturer according to the references provided. Additionally, it is recommended to implement firewall rules blocking external access to TCP port 7050 and review proxy configuration for exposure of loopback services.

Articatech Artica Proxy — versions indicated in the manufacturer's references