Security readout for executives and security teams
Plain-English summary
CVE-2026-24801 affects Ralim IronOS before v2.23-rc3. The public record describes a potential SPA vulnerability in TinyCrypt ECC/DSA-related code. Business urgency is moderate because the CVSS vector requires physical access and attack prerequisites, but confidentiality and integrity impacts are rated high.
Executive priority
Treat as a planned firmware remediation item, not an emergency internet-exposure incident. Prioritize environments where untrusted physical access to affected IronOS devices is plausible or where protected cryptographic material would matter.
Technical view
The issue is reported in IronOS source/Core/BSP/Pinecilv2/bl_mcu_sdk/components/ble/ble_stack/common/tinycrypt/source, associated with ecc_dsa.C. CVSS 4.0 score is 6.9 with AV:P, AC:L, AT:P, PR:N, UI:N, and high vulnerable/subsequent confidentiality and integrity impacts. A GitHub pull request is tagged as the patch reference.
Likely exposure
Exposure appears limited to deployments running Ralim IronOS versions before v2.23-rc3. The CVSS vector indicates physical access is required, reducing broad remote risk. Public sources do not identify specific device models beyond the IronOS project context.
Exploitation context
No active exploitation is reported in the provided sources, and the CVE is not marked KEV. The described SPA nature and physical-access vector suggest attacks would require close access and specialized conditions rather than internet-scale exploitation.
Researcher notes
The public record is sparse. The title and affected file suggest a side-channel concern, while the listed CWE-22 appears inconsistent with that description. Avoid assuming path traversal behavior from the CWE alone. Patch analysis should focus on PR 2087 and the TinyCrypt ECC/DSA changes.
Mitigation direction
- Upgrade IronOS to v2.23-rc3 or later where applicable.
- Review the referenced IronOS pull request for patch details.
- Follow Ralim project guidance before deploying firmware changes.
- Limit physical access to affected devices until upgraded.
Validation and detection
- Inventory devices or builds using Ralim IronOS.
- Confirm whether installed firmware is before v2.23-rc3.
- Check whether the patch from PR 2087 is present.
- Document devices that cannot be upgraded immediately.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-22: File access and web shell behavior lookup
File traversal and upload weaknesses can lead teams to review file, web shell, execution, and collection telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-24801 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.9 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/S:N/AU:N/R:U/V:C/RE:M/U:Red
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/S:N/AU:N/R:U/V:C/RE:M/U:Red——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
6.9MediumVector: CVSS:4.0/AV:P/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/S:N/AU:N/R:U/V:C/RE:M/U:Red
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/Ralim/IronOS/pull/2087CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.