CVE-2025-27093
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
Risk Assessment
The risk includes the possibility of attacks on operators by compromised clients and unauthorized access to port forwardings, which could lead to control over the infrastructure.
Recommendation
It is recommended to update Sliver to a version that includes the fix limiting traffic between Wireguard clients, and to review the configuration to ensure client isolation.
Other vulnerabilities in Sliver
See all- CVE-2026-34227High
Sliver before version 1.7.4 has a vulnerability where a single click on a malicious link gives an unauthenticated attacker immediate control over all active C2 sessions and beacons via the operator's browser, enabling data exfiltration or infrastructure destruction.
- CVE-2023-34758High
Sliver from versions 1.5.x to 1.5.39 has an improper cryptographic implementation, allowing attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
Original NVD description (English source)
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS