{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-18T18:29:53.716","vulnerabilities":[{"cve":{"id":"CVE-2025-54792","sourceIdentifier":"security-advisories@github.com","published":"2025-08-01T23:15:25.143","lastModified":"2025-09-03T14:12:26.090","vulnStatus":"Analyzed","cveTags":[],"descriptions":[{"lang":"en","value":"LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0."},{"lang":"es","value":"LocalSend es una aplicación de código abierto que permite compartir archivos y mensajes de forma segura con dispositivos cercanos a través de redes locales sin necesidad de conexión a internet. En las versiones 1.16.1 y anteriores, una vulnerabilidad crítica de Man-in-the-Middle (MitM) en el protocolo de descubrimiento del software permite a un atacante no autenticado en la misma red local suplantar la identidad de dispositivos legítimos, interceptando, leyendo y modificando silenciosamente cualquier transferencia de archivos. Esto puede utilizarse para robar datos confidenciales o inyectar malware, como ransomware, en archivos compartidos entre usuarios de confianza. El ataque es difícilmente detectable y fácil de implementar, lo que supone un riesgo de seguridad grave e inmediato. Este problema se solucionó en la versión 1.17.0."}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":9.3,"baseSeverity":"CRITICAL","attackVector":"ADJACENT","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","userInteraction":"PASSIVE","vulnConfidentialityImpact":"HIGH","vulnIntegrityImpact":"HIGH","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"HIGH","subIntegrityImpact":"HIGH","subAvailabilityImpact":"HIGH","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","baseScore":6.8,"baseSeverity":"MEDIUM","attackVector":"ADJACENT_NETWORK","attackComplexity":"HIGH","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.6,"impactScore":5.2}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-300"},{"lang":"en","value":"CWE-345"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:localsend:localsend:*:*:*:*:*:*:*:*","versionEndExcluding":"1.17.0","matchCriteriaId":"99B665EA-3DCE-4331-ACFE-C4A38FCF8D1B"}]}]}],"references":[{"url":"https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687","source":"security-advisories@github.com","tags":["Patch"]},{"url":"https://github.com/localsend/localsend/releases/tag/v1.17.0","source":"security-advisories@github.com","tags":["Release Notes"]},{"url":"https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","tags":["Exploit","Vendor Advisory"]}]}}]}