CVE-2025-27093: Sliver C2 Framework Auth Bypass Vulnerability

CVE-2025-27093 Overview

CVE-2025-27093 affects Sliver, an open source command and control (C2) framework maintained by Bishop Fox and used by red teams and adversaries alike. The vulnerability exists in the custom Wireguard netstack implementation shipped with Sliver versions 1.5.43 and earlier, plus the 1.6.0-dev development branch. The netstack fails to restrict traffic between Wireguard clients, allowing implants and operators sharing the same server to reach each other directly. The weakness is categorized as improper access control [CWE-284].

Critical Impact
Leaked or recovered Wireguard keypairs can be reused to pivot between implants, and operator port forwardings become reachable from other implants on the same C2 server.

Affected Products

Bishop Fox Sliver 1.5.43 and earlier
Bishop Fox Sliver 1.6.0-dev development branch
Deployments exposing Sliver Wireguard C2 listeners

Discovery Timeline

2025-10-28 - CVE-2025-27093 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27093

Vulnerability Analysis

Sliver embeds a user-space Wireguard implementation using golang.zx2c4.com/wireguard and a custom netstack that terminates TCP connections inside the server process. Each implant connects as a Wireguard peer and is assigned an IP inside the tunnel subnet. The netstack was configured to accept traffic destined for any address on the tunnel interface without filtering the source peer. As a result, one connected client could open TCP connections to another client's tunnel address or to operator-side port forwardings hosted on the same interface.

The practical effect is lateral reachability across the C2 mesh. An attacker who recovers or leaks an implant keypair (from memory, disk artifacts, or defensive extraction) can rejoin the Wireguard listener and reach operator services such as forwarded SOCKS, pivot listeners, or interactive shells intended for a different implant. Defenders analyzing a captured implant can likewise reach operator infrastructure exposed through the tunnel.

Root Cause

The root cause is missing peer-to-peer isolation inside the netstack. The server did not enumerate which TCP ports should be reachable, nor did it constrain which tunnel IP could originate connections to a given listening port. The patched code introduces explicit AllowTCPPort calls in server/c2/wireguard.go that bind listeners to the server's tunnel IP (tunIPAddr) for netstackPort and keyExchangeListenPort, so arbitrary client-to-client TCP flows are no longer accepted.

Attack Vector

Exploitation requires network access to the Sliver Wireguard listener and possession of a valid peer keypair. Once connected, the attacker sends TCP traffic to another peer's tunnel IP or to operator-only ports on the server's tunnel address. User interaction on the operator side is typically required to have previously established the port forwarding being abused.

// Patch excerpt: server/c2/wireguard.go
// Source: https://github.com/BishopFox/sliver/commit/8e5c5f14506d6d60ebb3362e6b9857ab1e0d76ff
tunIPAddr, err := netip.ParseAddr(tunIP)
if err != nil {
    wgLog.Errorf("ParseAddr failed: %v", err)
    return nil, nil, nil, err
}

// Allow netstack to listen on the ports we need
if err := tNet.AllowTCPPort(tunIPAddr, netstackPort); err != nil {
    wgLog.Errorf("AllowTCPPort failed for netstackPort: %v", err)
    return nil, nil, nil, err
}

if err := tNet.AllowTCPPort(tunIPAddr, keyExchangeListenPort); err != nil {
    wgLog.Errorf("AllowTCPPort failed for keyExchangeListenPort: %v", err)
    return nil, nil, nil, err
}

The fix constrains netstack listeners to the server's tunnel IP, breaking arbitrary cross-peer reachability. See the Bishop Fox Sliver security advisory GHSA-q8j9-34qf-7vq7 for the full disclosure.

Detection Methods for CVE-2025-27093

Indicators of Compromise

Sliver server processes (sliver-server) with active Wireguard listeners on non-standard UDP ports and no corresponding operator-authorized peers
Unexpected TCP connections inside the Wireguard tunnel subnet originating from an implant IP toward operator or peer IPs
Duplicate or reused Wireguard peer public keys observed connecting from distinct external source addresses

Detection Strategies

Hunt endpoints for Sliver implant artifacts using YARA and behavioral rules covering Sliver's HTTP, mTLS, DNS, and Wireguard transports
Alert on Go-based binaries initiating outbound Wireguard (UDP with Wireguard handshake magic bytes) to internet destinations from user workstations or servers
Correlate C2 beaconing telemetry with process lineage to identify implant execution before Wireguard peer traffic starts

Monitoring Recommendations

Log and review Wireguard peer configuration changes on any managed offensive infrastructure to catch unauthorized peers using recovered keys
Monitor egress firewalls for long-lived UDP flows to unfamiliar hosts, and capture flow records for retrospective analysis
Ingest endpoint process, network, and DNS telemetry into a centralized data lake so Sliver activity can be correlated across staging, delivery, and C2 phases

How to Mitigate CVE-2025-27093

Immediate Actions Required

Upgrade any authorized Sliver installations to a version containing commits 8e5c5f1 and 9122878, which enforce per-port listener binding
Rotate all Wireguard server and implant keypairs that were generated before patching, and revoke stale peers from the server configuration
Audit existing operator port forwardings and disable any that are not actively required during an engagement

Patch Information

The fix is delivered in two commits to the Bishop Fox Sliver repository: commit 8e5c5f14506d6d60ebb3362e6b9857ab1e0d76ff and commit 9122878cbbcae543eb8210f616550382af2065fd. Both add explicit tNet.AllowTCPPort calls in server/c2/wireguard.go and update netstack imports in server/netstack/tun.go so only the server's tunnel IP can host netstack and key-exchange ports.

Workarounds

Place the Sliver Wireguard listener behind a host firewall that restricts source addresses to known operator IPs
Use a separate Sliver server instance per engagement to avoid cross-tenant reachability between unrelated implants
Disable the Wireguard C2 listener and rely on alternate transports (mTLS, HTTPS, DNS) until the patched version is deployed

bash

# Verify Sliver server includes the fix by checking the commit hash of the built binary
git -C /path/to/sliver log --oneline | grep -E "8e5c5f1|9122878"

# Stop any unpatched Sliver Wireguard listeners from the sliver-server console
sliver > jobs
sliver > jobs -k <wg_job_id>