« Volver al listado

CVE-2026-25791

Estado: AnalizadaAlta (7.5)—

Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso remoto sin autenticación (AV:N, PR:N, UI:N) a listener DNS del C2 Sliver que causa agotamiento de memoria (A:H) y falsificación de sesiones sin validación OTP; impacto de denegación de servicio por exhaustión de recursos.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network TrafficVulnerability ScanningPrivileged Account ManagementPassword PoliciesNetwork SegmentationMulti-factor Authentication

Tecnologías afectadas (1)

Bishopfox — Sliver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-25791",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-25791",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-10T15:39:42.592936Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "BishopFox",
          "product": "sliver",
          "versions": [
            {
              "status": "affected",
              "version": "< 1.7.0"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-02-09T21:15:49.650",
  "references": [
    {
      "url": "https://github.com/BishopFox/sliver/releases/tag/v1.7.0",
      "tags": [
        "Product",
        "Release Notes"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/BishopFox/sliver/security/advisories/GHSA-wxrw-gvg8-fqjp",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        },
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Sliver is a command and control framework that uses a custom Wireguard netstack. Prior to 1.7.0, the DNS C2 listener accepts unauthenticated TOTP bootstrap messages and allocates server-side DNS sessions without validating OTP values, even when EnforceOTP is enabled. Because sessions are stored without a cleanup/expiry path in this flow, an unauthenticated remote actor can repeatedly create sessions and drive memory exhaustion. This vulnerability is fixed in 1.7.0."
    },
    {
      "lang": "es",
      "value": "Sliver es un framework de comando y control que utiliza un netstack Wireguard personalizado. Antes de la versión 1.7.0, el oyente DNS C2 acepta mensajes de arranque TOTP no autenticados y asigna sesiones DNS del lado del servidor sin validar los valores OTP, incluso cuando EnforceOTP está habilitado. Dado que las sesiones se almacenan sin una ruta de limpieza/caducidad en este flujo, un actor remoto no autenticado puede crear sesiones repetidamente y provocar el agotamiento de la memoria. Esta vulnerabilidad se corrige en la versión 1.7.0."
    }
  ],
  "lastModified": "2026-06-17T10:25:15.053",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:bishopfox:sliver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7BD4DFA2-8C16-4122-A4D8-C3E03081913D",
              "versionEndExcluding": "1.7.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com"
}