CVE-2023-34758 Silver vulnerable to MitM attack against implants due to a cryptography vulnerability
Attackers can perform man-in-the-middle attacks against Sliver C2 framework due to improper cryptographic implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-34758?
CVE-2023-34758 is a high-severity vulnerability in n/a, published on 28 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack via intercepted and crafted responses.
Weakness: CWE-327
Which versions are affected by CVE-2023-34758?
2 open source packages ship an affected version, including github.com/bishopfox/sliver. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/bishopfox/sliver Go | From 1.5.0 | 1.5.40 |
github.com/bishopfox/sliver Go | From 1.5.0 | 1.5.40 |
Products include Bishopfox Sliver.
How do I fix CVE-2023-34758?
Upgrade github.com/bishopfox/sliver to 1.5.40 or later.
Is CVE-2023-34758 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34758 exists.
Other vulnerabilities in n/a
- CVE-2026-25791 Sliver has a DNS C2 OTP Bypass Allows Unauthenticated Session Flooding and Denial of Service
- CVE-2025-27090 Server-Side Request Forgery (SSRF) in sliver teamserver
- CVE-2026-25760 Website Path Traversal / Arbitrary File Read (Authenticated) in Sliver
- CVE-2026-34227 Sliver One-Click Remote Access: Insecure CORS & Unauthenticated MCP Interface
- CVE-2026-32941 Sliver Vulnerable to Authenticated OOM via Memory Exhaustion in mTLS/WireGuard Transports
Sources
Also known as GHSA-8jxm-xp43-qh3q.