CVE-2026-25791: fallo de gravedad alta en BishopFox sliver
Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.4%
Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
BishopFox · sliverCVEs relacionadas — BishopFox sliver
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-41111HIGHBishopFox Sliver Authenticated Remote Code ExecutionEPSS 0.7%CVE-2025-27090MEDIUMServer-Side Request Forgery (SSRF) in sliver teamserverEPSS 0.6%CVE-2026-29781LOWSliver: Authenticated Nil-Pointer Dereference in HandlersEPSS 0.6%CVE-2026-25760MEDIUMWebsite Path Traversal / Arbitrary File Read (Authenticated) in SliverEPSS 0.5%CVE-2026-77622HIGHSliver: Unauthenticated Memory Exhaustion Denial of Service in Sliver HTTP(S) Listener PNG DecoderEPSS 0.5%CVE-2026-34227MEDIUMSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceEPSS 0.4%