CVE-2024-54855 describes a vulnerability in fabricators Ltd's Vanilla OS 2 Core image v1.1.0 where static SSH keys are embedded in the system image. This flaw can enable attackers to potentially intercept and manipulate SSH communications by conducting man-in-the-middle attacks. The vulnerability is classified under CWE-321 (Use of Hard-coded Cryptographic Key). The CVSS v3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, high privileges required, and user interaction needed. No known exploits in the wild or official patches have been reported.

The presence of static SSH keys compromises the confidentiality and availability of SSH sessions by allowing man-in-the-middle attacks. This can lead to unauthorized access to sensitive information and potential disruption of services relying on SSH connections.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using Vanilla OS 2 Core image v1.1.0 in sensitive environments or restrict SSH usage to trusted networks. Monitor vendor communications for updates on patches or mitigations.