PT-2026-20338 · Emp3R0R · Emp3R0R
Xtle0O0
·
Publicado
2026-02-17
·
Atualizado
2026-03-03
·
CVE-2026-26201
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
emp3r0r versions prior to 3.21.2
Description
The software accesses multiple shared maps without consistent synchronization across goroutines. Concurrent activity can trigger a
fatal error: concurrent map read and map write, leading to a C2 process crash and resulting in availability loss. The issue stems from mixed access patterns (iteration and mutation) without a single lock policy in maps such as the operator session map, port-forwarding session map, and FTP stream map. An attacker can trigger high concurrency, such as through rapid operator session churn and simultaneous agent message traffic, to exploit this condition. This results in a denial of service as the C2 component exits due to the panic.Recommendations
Versions prior to 3.21.2 should be updated to version 3.21.2 or later.
Exploit
Correção
Race Condition
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Emp3R0R