vulnwire
6.8med

CVE-2025-54792

LocalSend is Vulnerable to Man-in-the-Middle Attacks, Leading to File Interception

Published 15 mo ago · modified 4 mo ago · JSON

CVSS
6.8
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 22%
Public exploits
0
none known

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0.

CISA SSVC assessment

Exploitation
Proof of concept public
Automatable
no
Technical impact
total
Assessed
15 mo ago

Exploit prediction (EPSS)

0.29% probability of exploitation in the next 30 days, higher than 22% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA4.09.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
CNA4.09.3CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD3.16.8CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • localsend localsend

Classification

Weakness
  • CWE-300 Channel Accessible by Non-Endpoint
  • CWE-345 Insufficient Verification of Data Authenticity

References

  • github.com /localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f · x_refsource_CONFIRM, exploit
  • github.com /localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687 · x_refsource_MISC
  • github.com /localsend/localsend/releases/tag/v1.17.0 · x_refsource_MISC

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.