CVE-2025-62514

CVE-2025-62514 describes a critical vulnerability in Parsec's web application, specifically affecting versions on the 3.x branch prior to 3.6.0. The flaw, residing in the libparsec_crypto component when compiled with the RustCrypto backend, allows a man-in-the-middle (MITM) attacker to inject weak order points during a Diffie-Hellman exchange. This enables the attacker to derive the shared secret key, compromising the cryptographic security of file sharing sessions. Rated with a CVSS score of 7.1 (HIGH), this vulnerability has a network attack vector and high attack complexity, but requires low privileges and no user interaction. A successful exploit leads to high confidentiality and integrity impacts, as the attacker can decrypt and potentially alter shared files, with a low impact on availability. The FAUCET Risk Score is 93/100, indicating significant risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules for Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage are minimal, which is typical for a large percentage of CVEs. Users are advised to upgrade to Parsec version 3.6.0 immediately to mitigate this risk.