CVE-2025-54792
BaseFortify
Publication date: 2025-08-01
Last updated on: 2025-09-03
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| localsend | localsend | to 1.17.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-345 | The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data. |
| CWE-300 | The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a critical Man-in-the-Middle (MitM) flaw in LocalSend's discovery protocol in versions 1.16.1 and below. It allows an unauthenticated attacker on the same local network to impersonate legitimate devices, intercepting, reading, and modifying any file transfer silently. This means the attacker can steal sensitive data or inject malware into files shared between trusted users without detection.
How can this vulnerability impact me? :
The vulnerability can lead to severe security risks including theft of sensitive data and injection of malware such as ransomware into files shared between trusted users. Because the attack is silent and easy to perform, it can compromise the confidentiality and integrity of file transfers on the local network, potentially causing data breaches and system infections.
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to upgrade LocalSend to version 1.17.0 or later, where the critical Man-in-the-Middle vulnerability in the discovery protocol has been fixed. Until the upgrade is applied, avoid using LocalSend on untrusted or public local networks to reduce the risk of interception and tampering.