CVE-2024-23688 describes a cryptographic vulnerability in Consensys Discovery version 0 where the AES/GCM nonce is reused for the entire session rather than being unique for each message. This nonce reuse violates best practices for AES/GCM encryption, potentially exposing the session key used for specific peer communications. The node's private key remains secure, limiting the impact to the confidentiality of session keys. The vulnerability is categorized under CWE-323 (Reusing a Nonce, Key Pair in Encryption). No known exploits in the wild have been reported, and no patch or remediation information is currently available.

The vulnerability allows exposure of the session key used in peer communications due to nonce reuse in AES/GCM encryption. This compromises the confidentiality of the session key but does not affect the node's private key or integrity and availability of the system. The impact is limited to potential decryption of session-specific encrypted messages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid using affected versions or implement additional cryptographic safeguards if possible. Monitor official Consensys communications for updates on patches or mitigations.