CVE-2025-54792 (CNNVD-202508-112)
中文标题:
LocalSend 安全漏洞
英文标题:
LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception
漏洞描述
中文描述:
LocalSend是LocalSend开源的一个 AirDrop 的开源跨平台替代方案。 LocalSend 1.16.1及之前版本存在安全漏洞，该漏洞源于发现协议存在中间人攻击漏洞，可能导致文件传输拦截和修改。
英文描述:
LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0.
CWE类型:
标签:
受影响产品
| 厂商 | 产品 | 版本 | 版本范围 | 平台 | CPE |
|---|---|---|---|---|---|
| localsend | localsend | <= 1.17.0 | - | - |
cpe:2.3:a:localsend:localsend:<=_1.17.0:*:*:*:*:*:*:*
|
| localsend | localsend | * | - | - |
cpe:2.3:a:localsend:localsend:*:*:*:*:*:*:*:*
|
解决方案
中文解决方案:
英文解决方案:
临时解决方案:
参考链接
cve.org
cve.org
cve.org
CVSS评分详情
4.0 (cna)
CRITICALCVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
时间信息
利用信息
数据源详情
| 数据源 | 记录ID | 版本 | 提取时间 |
|---|---|---|---|
| CVE | cve_CVE-2025-54792 |
2025-11-11 15:23:29 | 2025-11-11 07:40:42 |
| NVD | nvd_CVE-2025-54792 |
2025-11-11 15:00:58 | 2025-11-11 07:48:30 |
| CNNVD | cnnvd_CNNVD-202508-112 |
2025-11-11 15:12:52 | 2025-11-11 08:00:04 |
版本与语言
安全公告
变更历史
查看详细变更
- vulnerability_type: 未提取 -> 其他
- cnnvd_id: 未提取 -> CNNVD-202508-112
- data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
查看详细变更
- affected_products_count: 1 -> 2
- data_sources: ['cve'] -> ['cve', 'nvd']