CVE-2024-0888 is a medium severity flaw (CVSS 5.3) in BORGChat. No fixed version is named in the record. This guide covers who is affected, how to check your exposure, and what to do now.
What's affected
BORGChat 1.0.0 Build 438, through the service on port 7551.
The record gives a CVSS base score of 5.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. The weakness class is CWE-404.
The record places the flaw in the service on port 7551 and says remote triggering is possible without authentication. A public exploit script is linked from the references, which this article does not reproduce.
The record says exploit details have been disclosed publicly, so assume that attackers can learn how the weakness works. The record names no fixed version and no vendor advisory. Check the project for a newer build.
How to check if you're exposed
Find any host running BORGChat and note the build number in the About dialog. The service listens on TCP port 7551, so a port inventory shows where it runs: nmap -p 7551 10.0.0.0/24 against your own ranges.
A free in-browser dependency scan at gold.safeguard.sh/scan can show whether a software package in your own projects matches this CVE, and the Gold directory entry for CVE-2024-0888 keeps the record details in one place. Reachability analysis helps you separate installations where the vulnerable code can actually be hit from those where it sits unused.
For hardware and appliances, no scanner will find them unless they are in an inventory, so start with a list of every device and application of this kind on your network.
What to do now
- Identify every instance of BORGChat in your environment, including test and forgotten systems.
- Compare the version you found with the affected range above.
- Look for a fixed release from the vendor or project. The record names no fixed version and no vendor advisory.
- Apply mitigations while you wait: block TCP 7551 at the host firewall and between network segments, and retire the chat tool if it is not essential.
- Review logs around the affected component for unusual requests.
- Record the decision and a re-check date in your vulnerability tracker.
Why it matters
The weakness is filed as CWE-404, improper resource shutdown or release. In practice that means a service takes input it should survive, then fails to clean up or keep running, so a remote sender can take it offline. The impact is availability only. The CVSS vector in the record shows no confidentiality or integrity impact.
A denial of service bug like this is rarely urgent on its own, but the service often sits on a network port that is easy to reach. If the product is part of something people depend on, a crash is still an outage, and repeated crashes can hide other activity in the noise.
The record shows this CVE is not in the CISA Known Exploited Vulnerabilities catalog, and none of the pages used for this article report exploitation in the wild.
Quick check
Is this a data theft bug?
No. The record scores availability impact only, with no confidentiality or integrity impact.
Where can I confirm the fixed version?
Check the vendor or project advisory first. The record names no fixed version and no vendor advisory. This article is based on the NVD record and the pages listed under Sources.
Sources
- https://vuldb.com/?ctiid.252039
- https://vuldb.com/?id.252039
- Safeguard Gold record for CVE-2024-0888
Last reviewed: 19 October 2026.
