CyberRota Analysis
AI-GeneratedThe emp3r0r command-and-control (C2) framework for Linux is vulnerable to exploitation due to its `http_poll` transport accepting unauthenticated HTTP polling sessions prior to completing MsgAuth authentication. This flaw allows remote attackers to create arbitrary polling sessions, potentially leading to resource exhaustion and unauthorized pre-auth C2 processing. Organizations using versions prior to 4.2.5 should prioritize patching to mitigate the risk of resource abuse and unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
emp3r0r is a C2 designed by Linux users for Linux environments. Prior to version 4.2.5, the `http_poll` C2 transport accepts attacker-controlled HTTP polling sessions before CBOR `MsgAuth` authentication is completed. A remote unauthenticated attacker can create arbitrary polling sessions and send request bodies that are forwarded into the C2 dispatch path. This can consume server resources and trigger pre-auth C2 processing. Version 4.2.5 patches the issue.