Threat operations/Vulnerabilities / CVE activity
AL
Member accessPublic view · sign in
How threat priority works

CVSS gives technical context. It never enters the VTP threat score. Public exploitation evidence and observations from your honeypots are separate facts.

Vulnerability threat dossier

CVE-2024-12849

Vendor unknownProduct mapping pending

Metadata pending authoritative retrieval.

VTP deterministic threat23.1of 100 · CVSS excluded

VTP analyst assessment

Unresolved vulnerability metadata with public template

AI-assisted analytical recommendationDoes not set factual exploitation state
AI review stateREVIEWED
AI priorityNONE
AI confidence70%
Public exploitation · VTP factUNKNOWN

Assessment

Authoritative metadata for CVE-2024-12849 is pending. ProjectDiscovery recorded a public exploit-oriented template, but the affected product, mechanism, and remediation are not established here.

Why it matters

  • The template may help identify this CVE where supported scanning is appropriate.
  • If you identify CVE-2024-12849 in your inventory, obtain vendor guidance before selecting remediation.

Evidence

2 record references and 1 source references passed trusted post-response validation. The current deterministic record contains 0 independent evidence groups.

Uncertainties

Affected product, impact, prerequisites, and exploit reliability are unknown.

Public template coverage does not establish active exploitation.

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

Next watchpoint

Track authoritative CVE publication and vendor remediation details.

AI baseline history (1)
  1. BASELINE ASSESSED
    Unresolved vulnerability metadata with public templategpt-5.6-terra · low
Technical severityUNKNOWNCVSS unknown · technical context
Public exploitationUNKNOWNGlobal public evidence
Exploit maturityPOCReliability not implied
EPSS0.4899th percentile · prediction
Evidence confidence90%Strongest independent active claim
VelocitySTABLEMaterial events only
First-party telemetryFirst-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.
Availability: SENSOR_ONLINE_NO_MATCHING_ACTIVITY · Evidence: UNKNOWN
01

VTP deterministic assessment

Why this matters

  1. 01

    A proof of concept is reported; functional reliability is not established.

  2. 02

    EPSS is 0.48; this is predictive context, not exploitation evidence.

  3. 03

    First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.

02

Material change ledger

What changed

EXPLOIT TEMPLATE AVAILABLEPublic exploit-oriented template available
03

Claim provenance

Evidence and source independence

1publications detected
1underlying evidence chains

0 primary sources · 0 dependent secondary reports · 0 reports with unresolved independence. Repetition remains visible without multiplying confirmation.

Source claimEXPLOIT TEMPLATE AVAILABLEPUBLIC EXPLOIT TEMPLATE
90%claim confidence
PRIMARYcorpus:NUCLEI:bf9f2b16be45e0f37fc97705ce32b69f17cf0f12ACTIVE
Evidence
04

Event history

Threat timeline

  1. 16:1213 Oct
    EXPLOIT TEMPLATE AVAILABLE

    Public exploit-oriented template available

    ProjectDiscovery nuclei-templates published new or materially changed exploit-oriented tooling for this CVE. This is availability evidence, not evidence of exploitation in the wild.

05

Original publications

Source record

ProjectDiscovery nuclei-templatesEXPLOIT INTELLIGENCEPRIMARY

Exploit tooling coverage changed for 1 CVE

ProjectDiscovery nuclei-templates recorded exploit-tooling coverage changes for 1 CVE in this pinned revision. 1 have an active availability assertion for this revision. Tooling evidence does not establish exploitation in the wild or successful execution.

CVE-2024-12849
Separate evidence group
Original
06

Technical vulnerability data

Context, not threat proof

VTP threat score23.1vtp-threat-v1-public
Public exploitation0 / 30
EPSS prediction9.61 / 20
Exploit availability7.5 / 15
Source independence0 / 15
Intelligence recency6 / 10
Threat acceleration0 / 10
CVSS technical severityExcluded
CVSS
Unknown · UNKNOWN
Vector
Unknown
CWE
Unknown
CPE records
0
Deterministic history records
6
07

Raw observations

First-party sensor records

First-party sensor telemetry is active; no disclosure-eligible deterministic observation is currently public for this CVE. This does not mean no activity was observed.