Crux Agent
Monthly
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.