Is CVE-2024-11053 actively exploited?

No active exploitation of CVE-2024-11053 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2024-11053 be exploited remotely?

Yes. CVE-2024-11053 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2024-11053?

CVE-2024-11053 has a CVSS score of 3.4 (LOW).

HOME VULNERABILITIESCVE-2024-11053

LOW

CVE-2024-11053

NVD-CWE-noinfoPublished: December 11, 2024· Updated: Jun 17, 2026

3.4

CVSS v3.1

Official Description

When asked to both use a `.netrc` file for credentials and to follow HTTP

redirects, curl could leak the password used for the first host to the

followed-to host under certain circumstances.

This flaw only manifests itself if the netrc file has an entry that matches

the redirect target hostname but the entry either omits just the password or

omits both login and password.

NVD Source

Technical Analysis

CVE-2024-11053 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation does not require any privileges, though user interaction (Required) is needed, which slightly reduces the risk of mass automated attacks.

The vulnerability has a "Changed" scope, meaning successful exploitation can impact components beyond the vulnerable component itself — such as the host operating system or adjacent services.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorNetwork

Attack ComplexityHigh

Privileges Req.None

User InteractionRequired

ScopeChanged

Impact

ConfidentialityLow

IntegrityNone

AvailabilityNone

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N

Affected Vendors & Products

haxx1 product(s)

curl

netapp18 product(s)

ontapontap select deploy administration utilityh610c firmwareh610ch610s firmwareh610sh615c firmwareh615ch700s firmwareh700sbootstrap oshci compute node+6

Source: NVD CPE · 19 total CPE entries

Exploit & PoC Resources

NO KNOWN EXPLOITNo public exploit confirmed at this time

Exploit-DB

Offensive Security exploit database

GitHub PoC Search

Community PoC repositories

Rapid7 / Metasploit

Metasploit module search

PacketStorm

Security advisories & exploits

External links open in a new tab. Always verify in a controlled environment before use.

Official Patches & Advisories

ADVISORYhttps://curl.se/docs/CVE-2024-11053.html

ADVISORYhttps://curl.se/docs/CVE-2024-11053.json

ADVISORYhttps://hackerone.com/reports/2829063

ADVISORYhttp://www.openwall.com/lists/oss-security/2024/12/11/1

ADVISORYhttps://security.netapp.com/advisory/ntap-20250124-0012/

ADVISORYhttps://security.netapp.com/advisory/ntap-20250131-0003/

News & Research Mentioning CVE-2024-11053

Siemens COMOS

CISA Alerts· Feb 12, 2026

View CSAF Summary COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens COMOS are affected: COMOS V10.4 vers:intdot/<10.4.5, vers:intdot/<10.4.5 (CVE-2024-47875, CVE-2025-2783) COMOS V10.4.5 vers:intdot/<10.4.5.0.2 (CVE-2024-11053, CVE-2025-10148) COMOS V10.5 vers:intdot/<10.5.2, vers:intdot/<10.5.2 (CVE-2025-2783, CVE-2024-47875) COMOS V10. [xlite_meta score:53 src:CISA Alerts xlite_fp:29eb0c7b55e4cae194626fc5a480e23617554ce492db959d2b386d3e2b007910]