CVE-2025-27093
published 2025-10-28CVE-2025-27093: Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the…
PriorityP336medium6.3CVSS 3.1
AVNACLPRNUIRSUCLILAL
EPSS
0.22%
12.1th percentile
Sliver is a command and control framework that uses a custom Wireguard netstack. In versions 1.5.43 and earlier, and in development version 1.6.0-dev, the netstack does not limit traffic between Wireguard clients. This allows clients to communicate with each other unrestrictedly, potentially enabling leaked or recovered keypairs to be used to attack operators or allowing port forwardings to be accessible from other implants.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| bishopfox | sliver | <= 1.5.43 | — |
| github.com | bishopfox_sliver | >= 0 < 1.5.44 | 1.5.44 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver
osv·2025-11-05
CVE-2025-27093 Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver
Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver
Silver has unrestricted traffic between Wireguard clients in github.com/bishopfox/sliver
OSV
Silver has unrestricted traffic between Wireguard clients
osv·2025-10-28
CVE-2025-27093 [MEDIUM] Silver has unrestricted traffic between Wireguard clients
Silver has unrestricted traffic between Wireguard clients
### Summary
Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to:
1. Leaked/recovered keypair (from a beacon) being used to attack operators.
2. Port forwardings usable from other implants.
### Details
1. Sliver treat operators' Wireguard config and beacon/session's Wireguard config equally, they both connect to the wireguard listener created from the CLI.
2. The current netstack implementation does not filter traffic between clients.
I think this piece of code handle traffic between clients, from experimental results clients can ping and connect to each other freely, and I didn't see any filtering here either:
```
File: server\c2\wireguard.go
246: func socketWGWriteEnvelope(conn
GHSA
Silver has unrestricted traffic between Wireguard clients
ghsa·2025-10-28
CVE-2025-27093 [MEDIUM] CWE-284 Silver has unrestricted traffic between Wireguard clients
Silver has unrestricted traffic between Wireguard clients
### Summary
Sliver's custom Wireguard netstack doesn't limit traffic between Wireguard clients, this could lead to:
1. Leaked/recovered keypair (from a beacon) being used to attack operators.
2. Port forwardings usable from other implants.
### Details
1. Sliver treat operators' Wireguard config and beacon/session's Wireguard config equally, they both connect to the wireguard listener created from the CLI.
2. The current netstack implementation does not filter traffic between clients.
I think this piece of code handle traffic between clients, from experimental results clients can ping and connect to each other freely, and I didn't see any filtering here either:
```
File: server\c2\wireguard.go
246: func socketWGWriteEnvelope(conn
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/BishopFox/sliver/commit/8e5c5f14506d6d60ebb3362e6b9857ab1e0d76ffhttps://github.com/BishopFox/sliver/commit/9122878cbbcae543eb8210f616550382af2065fdhttps://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7https://github.com/BishopFox/sliver/security/advisories/GHSA-q8j9-34qf-7vq7
2025-10-28
Published