CVE-2025-27093: falha de média gravidade em BishopFox sliver
Sliver does not restricted traffic between Wireguard clients.
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.3epss 0.3%
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Produtos afetados
BishopFox · sliverCVEs relacionadas — BishopFox sliver
No mesmo produto, das mais perigosas para as menos.
CVE-2024-41111HIGHBishopFox Sliver Authenticated Remote Code ExecutionEPSS 0.7%CVE-2025-27090MEDIUMServer-Side Request Forgery (SSRF) in sliver teamserverEPSS 0.6%CVE-2026-29781LOWSliver: Authenticated Nil-Pointer Dereference in HandlersEPSS 0.6%CVE-2026-25760MEDIUMWebsite Path Traversal / Arbitrary File Read (Authenticated) in SliverEPSS 0.5%CVE-2026-25791HIGHSliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of ServiceEPSS 0.5%CVE-2026-34227MEDIUMSliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP InterfaceEPSS 0.4%