« Volver al listado

CVE-2025-70954

Estado: AplazadaAlta (7.5)—

A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad de red sin autenticación (AV:N, PR:N, UI:N) en aplicación blockchain expuesta; null pointer dereference causa DoS de nodo validador al procesar transacción maliciosa.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementNetwork SegmentationLimit Access to Resource Over NetworkApplication Isolation and Sandboxing

Tecnologías afectadas (2)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

TON — TON BlockchainAITON — TON Virtual MachineAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-70954",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-70954",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-17T18:28:54.214129Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-13T22:16:10.047",
  "references": [
    {
      "url": "https://gist.github.com/Lucian-code233/04940a264cab50732cc07fd991749226",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ton-blockchain/ton/commit/9e5109d56bc4f2345a00b2271c3711103841b799",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/ton-blockchain/ton/releases/tag/v2025.06#:~:text=AArayz%2C%20wy666444%2C%20Robinlzw%2C%20Lucian-code233",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://mp.weixin.qq.com/s/IbRKrCKdMyIi-azkuqOOvg",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://www.tonbit.xyz/blog/post/TonBit-Discovers-Critical-Vulnerability-on-TON-Virtual-Machine-for-the-Third-Time-Once-Again-Receiving-Official-Recognition-from-the-TON-Team.html",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-476"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A Null Pointer Dereference vulnerability exists in the TON Virtual Machine (TVM) within the TON Blockchain before v2025.06. The issue is located in the execution logic of the INMSGPARAM instruction, where the program fails to validate if a specific pointer is null before accessing it. By sending a malicious transaction or smart contract, an attacker can trigger this null pointer dereference, causing the validator node process to crash (segmentation fault). This results in a Denial of Service (DoS) affecting the availability of the entire blockchain network."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad de desreferencia de puntero nulo existe en la Máquina Virtual TON (TVM) dentro de la cadena de bloques TON antes de la v2025.06. El problema se encuentra en la lógica de ejecución de la instrucción INMSGPARAM, donde el programa no valida si un puntero específico es nulo antes de acceder a él. Al enviar una transacción maliciosa o un contrato inteligente, un atacante puede desencadenar esta desreferencia de puntero nulo, provocando que el proceso del nodo validador falle (fallo de segmentación). Esto resulta en una Denegación de Servicio (DoS) que afecta la disponibilidad de toda la red de cadena de bloques."
    }
  ],
  "lastModified": "2026-06-17T10:03:28.380",
  "sourceIdentifier": "cve@mitre.org"
}