Security readout for executives and security teams
Plain-English summary
A bug in ArchiSteamFarm could accidentally remove the IPC password when a user updated global configuration. If that happened, unauthorized users might access ASF’s IPC interface. Most default installs are less exposed because IPC is localhost-only, but exposed or shared systems need prompt checking.
Executive priority
Treat as a moderate-priority configuration integrity issue. Prioritize internet-adjacent, shared-host, or non-default IPC deployments first. Default localhost-only installations should still verify password presence and upgrade during the next maintenance window.
Technical view
In ASF versions before 5.1.2.4, POST /Api/ASF global config updates could drop IPCPassword when the field was omitted, unintentionally disabling IPC authentication. The issue is tracked as CWE-287 with CVSS 6.8. Exposure depends on configuration state after update and IPC network reachability.
Likely exposure
Users running JustArchiNET ArchiSteamFarm before 5.1.2.4 who updated global ASF config through ASF-ui or the API. Default localhost-only IPC reduces typical exposure; risk rises if IPC is reachable from other hosts or local access is shared.
Exploitation context
The bundle does not show active exploitation, and CVE-2021-32794 is not listed as KEV. The risk is a configuration-removal bug requiring a config update path and resulting missing IPCPassword. Sources do not provide evidence of public weaponization.
Researcher notes
This is not described as a direct unauthenticated remote exploit. The vulnerable state appears after global config update behavior removes IPCPassword. Validate both software version and resulting configuration state; network exposure determines practical impact.
Mitigation direction
- Upgrade ArchiSteamFarm to version 5.1.2.4 or later.
- Verify IPCPassword remains set after any global configuration update.
- Set IPCPassword manually if it is missing.
- Keep IPC access restricted to localhost unless vendor guidance requires otherwise.
- Review vendor advisory and release notes for current operational guidance.
Validation and detection
- Inventory all ArchiSteamFarm instances and identify versions below 5.1.2.4.
- Inspect global ASF configuration for a present IPCPassword value.
- Confirm IPC is not reachable beyond intended local or trusted hosts.
- Review recent ASF-ui or API configuration updates for accidental password removal.
- Retest after upgrade or configuration correction.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-287: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-32794 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H0.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.8MediumVector: CVSS:3.1/AV:A/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/JustArchiNET/ArchiSteamFarm/security/advisories/GHSA-wxx4-66c2-vj2vCVE reference · x_refsource_CONFIRM
- https://github.com/JustArchiNET/ArchiSteamFarm/pull/2379CVE reference · x_refsource_MISC
- https://steamcommunity.com/groups/archiasf/discussions/6/3057365873428498659/CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Authentication
Improper Authentication represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.