CVE-2025-27093

Published Oct 28, 2025

Last updated 5 months ago

CVSS medium 6.3
Tunneling protocol

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-27093 affects the Sliver command and control framework, specifically versions 1.5.43 and earlier, as well as development version 1.6.0-dev. The vulnerability lies in the custom Wireguard netstack, which doesn't restrict traffic between Wireguard clients. This lack of traffic restriction allows clients to communicate freely with each other. Consequently, if an attacker gains access to leaked or recovered keypairs, they could potentially use them to target operators or access port forwardings from other implants.

Description
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
Source
security-advisories@github.com
NVD status
Deferred

Risk scores

CVSS 3.1

Type
Secondary
Base score
6.3
Impact score
3.4
Exploitability score
2.8
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Severity
MEDIUM

Weaknesses

security-advisories@github.com
CWE-284

Social media

Hype score
Not currently trending

  1. Sliver C2 Insecure Default Network Policy (CVE-2025-27093) #SliverC2 #Wireguard #CVE202527093 #NetworkPolicy #CommandAndControl https://t.co/sWNM3dKkmz

    @reverseame

    19 Mar 2026

    1439 Impressions

    2 Retweets

    15 Likes

    3 Bookmarks

    1 Reply

    0 Quotes

  2. Descubre la vulnerabilidad Sliver CVE-2025-27093 y su impacto en la seguridad. Más info: https://t.co/khlla5AsTb #Ciberseguridad #Vulnerabilidades

    @AlejosAngel

    27 Nov 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Sliver C2 Insecure Default Network Policy (CVE-2025-27093) Nov 17, 2025 https://t.co/4jCDFdmlQS

    @tdatwja

    22 Nov 2025

    240 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  4. Sliver C2 Insecure Default Network Policy (CVE-2025-27093) https://t.co/SsQSGboGZn

    @ipurple

    22 Nov 2025

    3556 Impressions

    10 Retweets

    31 Likes

    12 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-27093 Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack do… https://t.co/UVRV3Wn2V6

    @CVEnew

    28 Oct 2025

    242 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Related CVEs

  1. Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network.•CVE-2026-73009
  2. Zephyr's WireGuard VPN data-plane receive handler wg_process_data_message() in subsys/net/lib/wireguard/wg_crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE_TRANSPORT_DATA packet succeeded, the code committed several peer-state changes — update_peer_addr() (endpoint roaming update), the keypair->last_rx/peer->last_rx liveness timers, and keypair_update() (promote next→current and destroy the previous keypair) — and only afterward called wg_check_replay(). On a replayed packet the replay check returned -EINVAL, but none of the preceding mutations were rolled back. The AEAD tag authenticates content but not freshness, so a replayed-but-authentic transport packet decrypts correctly. An attacker who captures one valid ciphertext off the wire (an on-path or shared-medium observer) can re-inject it from an arbitrary spoofed source address. Reaching the handler requires no credentials: it is driven directly from inbound UDP datagrams via the dispatch in subsys/net/lib/wireguard/wg.c. Because the state mutations committed before the replay check, the replay repoints the peer endpoint to the attacker-chosen source address (roaming hijack), redirecting the victim's subsequent outbound tunnel traffic until the legitimate peer's next packet re-corrects it; it also prematurely destroys the previous keypair and refreshes the RX liveness timer. The tunnel payload stays encrypted under the session keypair, so this is an integrity/availability impact (traffic redirection and session disruption), not payload disclosure. The fix moves wg_check_replay() to immediately after a successful decrypt, before any peer-state mutation, matching the WireGuard specification and the Linux reference implementation.•CVE-2026-13734
  3. Logto is the modern, open-source auth infrastructure for SaaS and AI apps. Prior to 0.3.9, the Logto Tunnel npm package enabled createStaticFileProxy from packages/tunnel/src/commands/tunnel/index.ts and passed request.url from static asset requests through packages/tunnel/src/commands/tunnel/utils.ts using path.join(staticPath, request.url) and then fs.open(requestPath, "r") without URL normalization or a containment check. When --experience-path was enabled and the tunnel port was reachable, an unauthenticated requester could send a path containing ../ to createStaticFileProxy and read files outside the configured static directory that were readable by the logto-tunnel process. The service used server.listen(port), which could expose the tunnel to other hosts depending on the platform and deployment. This issue is fixed in version 0.3.9.•CVE-2026-63188
  4. The Windows interactive service in OpenVPN 2.4.0 through 2.6.21 and 2.7_alpha1 through 2.7.5 allows local authenticated users to bypass the trusted configuration directory constraint and load arbitrary configuration files via crafted options that bypass whitelist checks•CVE-2026-63649
  5. OpenVPN 2.7_alpha1 through 2.7.5 using mbedTLS allows remote authenticated users to be misidentified by ignoring the configured X.509 username identity lookup field•CVE-2026-63650

References

Sources include official advisories and independent security research.