PT-2025-44202 · Sliver · Sliver

Published 2025-10-28 · Updated 2026-03-19 · CVE-2025-27093

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Sliver versions 1.5.43 and earlier, and version 1.6.0-dev

Description Sliver is a command and control framework that utilizes a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This unrestricted communication allows clients to connect with each other, potentially enabling attackers to leverage leaked or recovered keypairs to compromise operators or access port forwardings from other implants. The Wireguard connection operates entirely within the process and does not expose itself as a network interface. An attacker can obtain a valid Wireguard configuration and connect to the operator’s machine, potentially accessing services listening on all interfaces (0.0.0.0), such as SSH, RDP, or SMB. The private key of a beacon can be recovered through process dumping, allowing an attacker to generate new Wireguard clients without the operator’s knowledge, achieving persistence within the network.

Recommendations Versions prior to 1.5.43 and version 1.6.0-dev should implement traffic filtering between clients using a default-deny policy. Differentiate between operator and beacon Wireguard configurations/clients. Only allow specific one-way traffic when an operator requests a Wireguard port forward.

Exploit

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-27093

GHSA-Q8J9-34QF-7VQ7

GO-2025-4079

OPENSUSE-SU-2025:15710-1

Affected Products

Sliver

References · 89

• 🔥 https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27093.json · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q8j9-34qf-7vq7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27093 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27093 · Security Note
• https://github.com/BishopFox/sliver · Note
• https://github.com/BishopFox/sliver/commit/8e5c5f14506d6d60ebb3362e6b9857ab1e0d76ff · Note
• https://github.com/BishopFox/sliver/commit/9122878cbbcae543eb8210f616550382af2065fd · Note
• https://suse.com/security/cve/CVE-2016-11084 · Note
• https://suse.com/security/cve/CVE-2025-54293 · Note
• https://suse.com/security/cve/CVE-2025-54291 · Note
• https://suse.com/security/cve/CVE-2025-62705 · Note
• https://suse.com/security/cve/CVE-2025-62714 · Note