CVE-2025-54792: localsend — Exploit & Fix

Description

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0.

Is your site exposed to CVE-2025-54792?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.8

MEDIUM

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness Type (CWE)

CWE-300 CWE-300

CWE-345 CWE-345

Affected Products

Vendor	Product	Versions
localsend	localsend	< 1.17.0

References

Advisories & Patches

https://github.com/localsend/localsend/commit/e8635204ec782ded45bc7d698deb60f3c4105687 https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f

Exploits

https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f https://github.com/localsend/localsend/security/advisories/GHSA-424h-5f6m-x63f

Other References

https://github.com/localsend/localsend/releases/tag/v1.17.0

Frequently Asked Questions

What is CVE-2025-54792? +

LocalSend is an open-source app to securely share files and messages with nearby devices over local networks without needing an internet connection. In versions 1.16.1 and below, a critical Man-in-the-Middle (MitM) vulnerability in the software's discovery protocol allows an unauthenticated attacker on the same local network to impersonate legitimate devices, silently intercepting, reading, and modifying any file transfer. This can be used to steal sensitive data or inject malware, like ransomware, into files shared between trusted users. The attack is hardly detectable and easy to implement, posing a severe and immediate security risk. This issue was fixed in version 1.17.0. It has a CVSS v3.1 base score of 6.8 (MEDIUM).

How severe is CVE-2025-54792? +

CVE-2025-54792 has a CVSS v3.1 score of 6.8 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2025-54792? +

CVE-2025-54792 affects products from localsend, specifically: localsend. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-54792? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-12991

The lack of cryptographic mechanisms to ensure the integrity and authenticity of communications in Ghost Robotics' Vision 60 robot (APK …

CVE-2023-31004 8.3

IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 …

CVE-2024-31206 8.2

dectalk-tts is a Node package to interact with the aeiou Dectalk web API. In `[email protected]`, network requests to the third-party …

CVE-2025-31214 8.1

This issue was addressed through improved state management. This issue is fixed in iOS 18.5 and iPadOS 18.5. An attacker …

CVE-2024-36553 8.1

Forever KidsWatch Call Me KW-50 R36_YDR_A3PW_GM7S_V1.0_2019_07_15_16.19.24_cob_h is vulnerable to MITM attack.

CVE-2025-20122 7.8

A vulnerability in the CLI of Cisco Catalyst SD-WAN Manager, formerly Cisco SD-WAN vManage, could allow an authenticated, local attacker …

CVE-2025-54792