Sliver C2 CVE-2025-27093

Exploitation requires the attacker to be a peer on the Sliver WireGuard overlay network. Concretely, per the advisory, this means either (a) legitimately holding two or more operator/beacon WireGuard configs that connect to the same CLI-created WireGuard listener, or (b) recovering a beacon's WireGuard private key, public key and endpoint from a process memory dump or other forensic access to a deployed implant. Once a peer, the missing netstack traffic filtering lets the attacker reach other clients and operator services (e.g. SSH/RDP/SMB bound to 0.0.0.0 on the WG interface IP such as 100.64.0.3) and the key-exchange listener at 100.64.0.1:1337. LIMITING FACTORS: the flaw only affects environments actually using Sliver's WireGuard transport with port forwarding/operator WG configs as documented; it is not reachable from the general internet, requires valid WireGuard keymaterial or peer position, and the highest-value abuse (attacking operators) depends on the operator using an OS-integrated WireGuard client with services listening on 0.0.0.0.

The signals here are consistent and point to a moderate, situational risk rather than an urgent emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L = 6.3 Medium) describes a network-reachable flaw with low-complexity, but the three impact metrics are all Low, reflecting lateral-reach/segmentation failure rather than direct code execution. EPSS is low (0.24%, 14th percentile), which aligns with the lack of KEV listing - there is no evidence of active or widespread exploitation. A PoC is documented in the GitHub Security Advisory (GHSA-q8j9-34qf-7vq7), so publicly available exploit guidance exists, but this must not be conflated with in-the-wild exploitation. A key nuance the CVSS vector understates: this is a security TOOL (an offensive C2 framework), so the 'victims' are red-team operators and the attack population is implants/peers already inside the WireGuard overlay. The PR:N rating is questionable - realistic abuse requires either possessing a valid WireGuard keypair (recovered via beacon process dump/forensics) or already being a deployed client on the overlay, which is a meaningful precondition the scored vector does not capture (see assessed vector). Net: a genuine operational-security concern for Sliver users that should be patched, but not a mass-exploitation internet-facing threat; EPSS-low + no-KEV + tool-niche footprint place it well below drop-everything priority.

An attacker who controls or forensically examines a deployed Sliver beacon recovers its WireGuard private key, endpoint and public key from a process memory dump, then connects to the Sliver WireGuard listener as a legitimate peer. Because the custom netstack performs no inter-client traffic filtering, the attacker reaches operator services (RDP/SSH/SMB on the WG interface IP) or other implants' port forwards, and can even hit the key-exchange listener (100.64.0.1:1337) to mint new clients for persistence. A PoC demonstrating client-to-client ping/scan/connect and the key-recovery path is published in the GHSA advisory.