PT-2025-27383 · Rlpx · Rlpx

Published 2025-06-29 · Updated 2025-06-30 · CVE-2015-20112

Positive Technologies (AI Summary)

CVSS v3.1

3.4

Low

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: RLPx version 5

Description: The issue concerns RLPx 5, which has two CTR streams based on the same key, IV, and nonce. This design flaw can facilitate decryption on a private network.

Recommendations: For RLPx version 5, consider reconfiguring the CTR streams to use distinct keys, IVs, and nonces to prevent potential decryption on private networks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-325

Related Identifiers

CVE-2015-20112

Affected Products

Rlpx

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-20112 · Security Note
• https://github.com/ethereum/go-ethereum/issues/1315 · Note
• https://github.com/hyperledger/besu/issues/7926 · Note
• https://github.com/ethereum/devp2p/issues/32 · Note
• https://github.com/ethereum/devp2p/blob/master/rlpx.md#known-issues-in-the-current-version · Note
• https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1bcf5761478f852398365901 · Note
• https://t.me/cvenotify/127037 · Telegram Post
• https://t.me/cvetracker/27375 · Telegram Post