CVE-2025-1146
Estado: AplazadaAlta (8.1)—
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.
Leer descripción completaMostrar menos
CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so.
Windows and Mac sensors are not affected by this.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 8.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.26%
- Percentil entre todas las CVEs puntuadas: 16
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1557Adversary-in-the-Middlecredential access · collection85 % - Impacto principal
T1090Proxycommand and control80 % - Impacto secundario
T1005Data from Local Systemcollection75 %
CWE-296: validación incorrecta de certificado TLS permite interceptación de tráfico (MITM). AV:N requiere control de red; impactos: proxy/redirección (T1090) y acceso a datos en tránsito (T1005).
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (3)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
CWE
- CWE-296
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2025-1146",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-1146",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"version": "2.0.3",
"timestamp": "2025-02-12T19:40:26.132160Z"
}
}
],
"cvssMetricV31": [
{
"type": "Secondary",
"source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.1,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.2
}
]
},
"affected": [
{
"source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
"affectedData": [
{
"vendor": "CrowdStrike",
"product": "Falcon sensor for Linux",
"versions": [
{
"status": "unaffected",
"version": "7.21.17405",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.20",
"lessThan": "7.20.17308",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.19",
"lessThan": "7.19.17221",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.18",
"lessThan": "7.18.17131",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.17",
"lessThan": "7.17.17014",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.16",
"lessThan": "7.16.16909",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.15",
"lessThan": "7.15.16806",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.14",
"lessThan": "7.14.16705",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.13",
"lessThan": "7.13.16606",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.11",
"lessThan": "7.11.16410",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.10",
"lessThan": "7.10.16321",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.07",
"lessThan": "7.07.16209",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.06",
"lessThan": "7.06.16113",
"versionType": "semver"
}
],
"platforms": [
"Linux"
],
"packageName": "falcon-sensor",
"defaultStatus": "unknown"
},
{
"vendor": "CrowdStrike",
"product": "Falcon Kubernetes Admission Controller",
"versions": [
{
"status": "unaffected",
"version": "7.21.1904",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.20",
"lessThan": "7.20.1808",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.18",
"lessThan": "7.18.1605",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.17",
"lessThan": "7.17.1503",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.16",
"lessThan": "7.16.1403",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.14",
"lessThan": "7.14.1203",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.13",
"lessThan": "7.13.1102",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.12",
"lessThan": "7.12.1002",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.11",
"lessThan": "7.11.904",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.10",
"lessThan": "7.10.806",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.06",
"lessThan": "7.06.603",
"versionType": "semver"
}
],
"platforms": [
"Linux"
],
"defaultStatus": "unknown"
},
{
"vendor": "CrowdStrike",
"product": "Falcon Container Sensor",
"versions": [
{
"status": "unaffected",
"version": "7.21.6003",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.20",
"lessThan": "7.20.5908",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.19",
"lessThan": "7.19.5807",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.18",
"lessThan": "7.18.5705",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.17",
"lessThan": "7.17.5603",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.16",
"lessThan": "7.16.5503",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.15",
"lessThan": "7.15.5403",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.14",
"lessThan": "7.14.5306",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.13",
"lessThan": "7.13.5202",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.12",
"lessThan": "7.12.5102",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.11",
"lessThan": "7.11.5003",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.10",
"lessThan": "7.10.4907",
"versionType": "semver"
},
{
"status": "affected",
"version": "7.06",
"lessThan": "7.06.4705",
"versionType": "semver"
}
],
"platforms": [
"Linux"
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2025-02-12T19:15:09.840",
"references": [
{
"url": "https://www.crowdstrike.com/security-advisories/cve-2025-1146/",
"source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
"description": [
{
"lang": "en",
"value": "CWE-296"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\n\n \nCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \n\n\nWindows and Mac sensors are not affected by this."
},
{
"lang": "es",
"value": "CrowdStrike utiliza el estándar industrial TLS (seguridad de la capa de transporte) para proteger las comunicaciones desde el sensor Falcon a la nube de CrowdStrike. CrowdStrike ha identificado un error en la lógica de validación en el sensor Falcon para Linux, Falcon Kubernetes Admission Controller y Falcon Container Sensor, donde nuestra rutina de conexión TLS a la nube de CrowdStrike puede procesar incorrectamente la validación del certificado del servidor. Esto podría permitir que un atacante con la capacidad de controlar el tráfico de la red realice potencialmente un ataque de intermediario (MiTM). CrowdStrike identificó este problema internamente y lanzó una corrección de seguridad en todas las versiones 7.06 y posteriores del sensor Falcon para Linux, Falcon Kubernetes Admission Controller y Falcon Container Sensor. CrowdStrike identificó este problema a través de nuestro riguroso y prolongado proceso de revisión de seguridad, que se ha fortalecido continuamente con un análisis más profundo del código fuente y mejoras continuas del programa como parte de nuestro compromiso con la resiliencia de la seguridad. CrowdStrike no tiene indicios de ninguna explotación de este problema en la naturaleza. CrowdStrike ha aprovechado sus capacidades de inteligencia y búsqueda de amenazas de primer nivel para monitorear activamente los indicios de abuso o uso de esta falla y continuará haciéndolo. Los sensores de Windows y Mac no se ven afectados por esto."
}
],
"lastModified": "2026-06-17T08:38:27.630",
"sourceIdentifier": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661"
}