Wireguard
Monthly
Netmaker versions prior to 1.5.0 fail to properly validate host JWT tokens during authorization, allowing any attacker with knowledge of target object identifiers to bypass access controls and read, modify, or delete resources across different hosts. The vulnerability affects critical operations including node management, host deletion, and failover configurations, requiring only a valid host token and network access to exploit. Update to version 1.5.0 or later to remediate.
Privilege escalation in WireGuard Portal prior to version 2.1.3 allows authenticated non-admin users to gain full administrator access by modifying their own user profile with an IsAdmin flag set to true. The vulnerability exists because the server fails to properly validate and restrict the IsAdmin field during profile updates, allowing the privilege change to persist after re-authentication. Affected deployments require immediate patching to version 2.1.3 or later to prevent unauthorized administrative access.
Memory exhaustion in Sliver C2 framework prior to version 1.7.0 allows unauthenticated remote attackers to bypass OTP validation in the DNS listener and create unbounded server-side sessions without expiry mechanisms. Public exploit code exists for this vulnerability, enabling attackers to repeatedly allocate sessions and exhaust server memory resources. The DNS C2 listener accepts bootstrap messages without proper authentication even when OTP enforcement is enabled.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
Netmaker versions prior to 1.5.0 expose WireGuard private keys through unauthenticated API endpoints when accessed by users with the platform-user role, allowing credential theft across all network configurations despite UI-level access restrictions. An authenticated attacker can retrieve sensitive cryptographic material by directly calling GET /api/extclients/{network} or GET /api/nodes/{network} endpoints that lack proper output filtering. This vulnerability affects Netmaker and its integrated WireGuard deployments, with no patch currently available for affected versions.
Netmaker versions prior to 1.5.0 fail to properly validate role assignments in the user update API endpoint, allowing authenticated admin users to escalate their privileges to super-admin. An attacker with admin credentials can exploit this authorization bypass to gain unrestricted access to the platform. No patch is currently available for affected installations.
Cilium versions 1.18.0-1.18.5 with Native Routing, WireGuard, and Node Encryption enabled incorrectly allow cross-node Pod traffic that should be blocked, enabling unauthorized network access between isolated workloads. An attacker with network access to pods on different nodes can bypass network segmentation policies to access restricted services. The vulnerability affects deployments using these specific Cilium configurations and is resolved in version 1.18.6.
Authenticated operators in Sliver C2 framework versions prior to 1.6.11 can read arbitrary files on the server through a path traversal vulnerability in the website content subsystem, potentially exposing sensitive credentials, configurations, and cryptographic keys. Public exploit code exists for this vulnerability. The issue is resolved in version 1.6.11 and later.
Protonvpn versions up to 1.26.0 contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7.8).
Unrestricted client-to-client traffic in Sliver's custom WireGuard netstack (1.5.43 and earlier, plus the 1.6.0-dev development build) lets any peer on the same WireGuard overlay reach every other peer, so a leaked or memory-recovered beacon keypair can be used to attack operators or to reach port forwardings exposed by other implants. Exploitation is not possible from the general internet: the attacker must already occupy a peer position on the Sliver WireGuard network, either by holding operator/beacon configurations that connect to the same CLI-created listener or by extracting a beacon's private key, public key and endpoint from a process dump. Vendor-released patch: 1.5.44. EPSS is low (0.24%, 14th percentile) and the CVE is not in CISA KEV; no public exploit code identified at time of analysis, though the upstream advisory describes a step-by-step reproduction procedure.
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Netmaker versions prior to 1.5.0 fail to properly validate host JWT tokens during authorization, allowing any attacker with knowledge of target object identifiers to bypass access controls and read, modify, or delete resources across different hosts. The vulnerability affects critical operations including node management, host deletion, and failover configurations, requiring only a valid host token and network access to exploit. Update to version 1.5.0 or later to remediate.
Privilege escalation in WireGuard Portal prior to version 2.1.3 allows authenticated non-admin users to gain full administrator access by modifying their own user profile with an IsAdmin flag set to true. The vulnerability exists because the server fails to properly validate and restrict the IsAdmin field during profile updates, allowing the privilege change to persist after re-authentication. Affected deployments require immediate patching to version 2.1.3 or later to prevent unauthorized administrative access.
Memory exhaustion in Sliver C2 framework prior to version 1.7.0 allows unauthenticated remote attackers to bypass OTP validation in the DNS listener and create unbounded server-side sessions without expiry mechanisms. Public exploit code exists for this vulnerability, enabling attackers to repeatedly allocate sessions and exhaust server memory resources. The DNS C2 listener accepts bootstrap messages without proper authentication even when OTP enforcement is enabled.
Crux Agent versions 1.9.0 through 2.0.2 mishandle the WireGuard preshared key derived from the Crux SKA bilocation key: when a peering session negotiates SHA-512 the derived key is 64 bytes rather than the 32 bytes WireGuard requires, and the agent neither validates the size nor detects that its `wg set` command failed, so it writes an invalid key to the WireGuard configuration and only surfaces the problem when the tunnel is restarted. The confidentiality-relevant variant applies to peers that have never successfully negotiated a valid 32-byte bilocation key in a Crux C2 organization where the "Enforce SKA Use" setting is turned off, resulting in no preshared key being applied at all, which exposes intercepted tunnel traffic to decryption by an adversary holding (or later acquiring) a cryptographically relevant quantum computer - a harvest-now-decrypt-later exposure, not an immediately realizable attack. Rated CVSS 6.3 (CVSS:4.0/AV:N/AC:H/PR:N/UI:N/VC:H/VI:N/VA:N/S:N/AU:Y/R:A/V:C, unauthenticated), with no public exploit identified at time of analysis.
Netmaker versions prior to 1.5.0 expose WireGuard private keys through unauthenticated API endpoints when accessed by users with the platform-user role, allowing credential theft across all network configurations despite UI-level access restrictions. An authenticated attacker can retrieve sensitive cryptographic material by directly calling GET /api/extclients/{network} or GET /api/nodes/{network} endpoints that lack proper output filtering. This vulnerability affects Netmaker and its integrated WireGuard deployments, with no patch currently available for affected versions.
Netmaker versions prior to 1.5.0 fail to properly validate role assignments in the user update API endpoint, allowing authenticated admin users to escalate their privileges to super-admin. An attacker with admin credentials can exploit this authorization bypass to gain unrestricted access to the platform. No patch is currently available for affected installations.
Cilium versions 1.18.0-1.18.5 with Native Routing, WireGuard, and Node Encryption enabled incorrectly allow cross-node Pod traffic that should be blocked, enabling unauthorized network access between isolated workloads. An attacker with network access to pods on different nodes can bypass network segmentation policies to access restricted services. The vulnerability affects deployments using these specific Cilium configurations and is resolved in version 1.18.6.
Authenticated operators in Sliver C2 framework versions prior to 1.6.11 can read arbitrary files on the server through a path traversal vulnerability in the website content subsystem, potentially exposing sensitive credentials, configurations, and cryptographic keys. Public exploit code exists for this vulnerability. The issue is resolved in version 1.6.11 and later.
Protonvpn versions up to 1.26.0 contains a vulnerability that allows attackers to potentially execute arbitrary code (CVSS 7.8).
Unrestricted client-to-client traffic in Sliver's custom WireGuard netstack (1.5.43 and earlier, plus the 1.6.0-dev development build) lets any peer on the same WireGuard overlay reach every other peer, so a leaked or memory-recovered beacon keypair can be used to attack operators or to reach port forwardings exposed by other implants. Exploitation is not possible from the general internet: the attacker must already occupy a peer position on the Sliver WireGuard network, either by holding operator/beacon configurations that connect to the same CLI-created listener or by extracting a beacon's private key, public key and endpoint from a process dump. Vendor-released patch: 1.5.44. EPSS is low (0.24%, 14th percentile) and the CVE is not in CISA KEV; no public exploit code identified at time of analysis, though the upstream advisory describes a step-by-step reproduction procedure.
The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses non-RFC1918 IP addresses is blocked. Rated medium severity (CVSS 5.7), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.