Vulnerability-Lookup

BDU:2025-09075 (CVE-2025-1146)

Vulnerability from fstec – Published: 2025-07-28 – Updated: 2025-07-28 – View on bdu.fstec.ru Fixed

Title

Уязвимость реализации протокола TLS программного средства защиты конечных точек Crowdstrike Falcon, позволяющая нарушителю выполнить атаку типа «человек посередине»

Summary

Уязвимость реализации протокола TLS программного средства защиты конечных точек Crowdstrike Falcon связана с отсутствием отслеживания цепочки доверия при проверке сертификата. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить атаку типа «человек посередине»

Severity

7.6 (High) CVSS 2.0


                      
                        AV:N/AC:H/Au:N/C:C/I:C/A:C

8.1 (High) CVSS 3.1


                      
                        CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Class

Code vulnerability

Status

Confirmed by the vendor

Exploitation

Data structure manipulation

Incidents

Being clarified

Remediation

Software update

CWE

CWE-296 - Отсутствие отслеживания цепочки доверия при проверке сертификата

Aliases

CVE-2025-1146

References

3 references

URL
https://nvd.nist.gov/vuln/detail/CVE-2025-1146
https://www.crowdstrike.com/security-advisories/cve-2025-1146/
https://vulners.com/cve/CVE-2025-1146

Impacted products

3 products from 2 vendors

Vendors

CrowdStrike Holdings, Inc.

Products

Falcon sensor, Falcon Kubernetes Admission Controller, Falcon Container Sensor

Versions

до 7.21.17405 (Falcon sensor), до 7.20.17308 (Falcon sensor), до 7.19.17221 (Falcon sensor), до 7.18.17131 (Falcon sensor), до 7.17.17014 (Falcon sensor), до 7.16.16909 (Falcon sensor), до 7.15.16806 (Falcon sensor), до 7.14.16705 (Falcon sensor), до 7.13.16606 (Falcon sensor), до 7.11.16410 (Falcon sensor), до 7.10.16321 (Falcon sensor), до 7.07.16209 (Falcon sensor), до 7.06.16113 (Falcon sensor), до 7.21.1904 (Falcon Kubernetes Admission Controller), до 7.20.1808 (Falcon Kubernetes Admission Controller), до 7.18.1605 (Falcon Kubernetes Admission Controller), до 7.17.1503 (Falcon Kubernetes Admission Controller), до 7.16.1403 (Falcon Kubernetes Admission Controller), до 7.14.1203 (Falcon Kubernetes Admission Controller), до 7.13.1102 (Falcon Kubernetes Admission Controller), до 7.12.1002 (Falcon Kubernetes Admission Controller), до 7.11.904 (Falcon Kubernetes Admission Controller), до 7.10.806 (Falcon Kubernetes Admission Controller), до 7.06.603 (Falcon Kubernetes Admission Controller), до 7.21.6003 (Falcon Container Sensor), до 7.20.5908 (Falcon Container Sensor), до 7.19.5807 (Falcon Container Sensor), до 7.18.5705 (Falcon Container Sensor), до 7.17.5603 (Falcon Container Sensor), до 7.16.5503 (Falcon Container Sensor), до 7.15.5403 (Falcon Container Sensor), до 7.14.5306 (Falcon Container Sensor), до 7.13.5202 (Falcon Container Sensor), до 7.12.5102 (Falcon Container Sensor), до 7.11.5003 (Falcon Container Sensor), до 7.10.4907 (Falcon Container Sensor), до 7.06.4705 (Falcon Container Sensor)

Product types

Application software

Mitigations

Использование рекомендаций производителя: https://www.crowdstrike.com/security-advisories/cve-2025-1146/

JSON

To clipboard

{
  "CVSS 2.0": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
  "CVSS 3.0": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "CVSS 4.0": null,
  "remediation_\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": null,
  "remediation_\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435": null,
  "\u0412\u0435\u043d\u0434\u043e\u0440 \u041f\u041e": "CrowdStrike Holdings, Inc.",
  "\u0412\u0435\u0440\u0441\u0438\u044f \u041f\u041e": "\u0434\u043e 7.21.17405 (Falcon sensor), \u0434\u043e 7.20.17308 (Falcon sensor), \u0434\u043e 7.19.17221 (Falcon sensor), \u0434\u043e 7.18.17131 (Falcon sensor), \u0434\u043e 7.17.17014 (Falcon sensor), \u0434\u043e 7.16.16909 (Falcon sensor), \u0434\u043e 7.15.16806 (Falcon sensor), \u0434\u043e 7.14.16705 (Falcon sensor), \u0434\u043e 7.13.16606 (Falcon sensor), \u0434\u043e 7.11.16410 (Falcon sensor), \u0434\u043e 7.10.16321 (Falcon sensor), \u0434\u043e 7.07.16209 (Falcon sensor), \u0434\u043e 7.06.16113 (Falcon sensor), \u0434\u043e 7.21.1904 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.20.1808 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.18.1605 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.17.1503 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.16.1403 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.14.1203 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.13.1102 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.12.1002 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.11.904 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.10.806 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.06.603 (Falcon Kubernetes Admission Controller), \u0434\u043e 7.21.6003 (Falcon Container Sensor), \u0434\u043e 7.20.5908 (Falcon Container Sensor), \u0434\u043e 7.19.5807 (Falcon Container Sensor), \u0434\u043e 7.18.5705 (Falcon Container Sensor), \u0434\u043e 7.17.5603 (Falcon Container Sensor), \u0434\u043e 7.16.5503 (Falcon Container Sensor), \u0434\u043e 7.15.5403 (Falcon Container Sensor), \u0434\u043e 7.14.5306 (Falcon Container Sensor), \u0434\u043e 7.13.5202 (Falcon Container Sensor), \u0434\u043e 7.12.5102 (Falcon Container Sensor), \u0434\u043e 7.11.5003 (Falcon Container Sensor), \u0434\u043e 7.10.4907 (Falcon Container Sensor), \u0434\u043e 7.06.4705 (Falcon Container Sensor)",
  "\u0412\u043e\u0437\u043c\u043e\u0436\u043d\u044b\u0435 \u043c\u0435\u0440\u044b \u043f\u043e \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044e": "\u0418\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0439 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044f:\nhttps://www.crowdstrike.com/security-advisories/cve-2025-1146/",
  "\u0414\u0430\u0442\u0430 \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u0438\u044f": "12.02.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0433\u043e \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f": "28.07.2025",
  "\u0414\u0430\u0442\u0430 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0438": "28.07.2025",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440": "BDU:2025-09075",
  "\u0418\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u0441\u0438\u0441\u0442\u0435\u043c \u043e\u043f\u0438\u0441\u0430\u043d\u0438\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "CVE-2025-1146",
  "\u0418\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f \u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0430",
  "\u041a\u043b\u0430\u0441\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043a\u043e\u0434\u0430",
  "\u041d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 \u041f\u041e": "Falcon sensor, Falcon Kubernetes Admission Controller, Falcon Container Sensor",
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u041e\u0421 \u0438 \u0442\u0438\u043f \u0430\u043f\u043f\u0430\u0440\u0430\u0442\u043d\u043e\u0439 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u044b": null,
  "\u041d\u0430\u0438\u043c\u0435\u043d\u043e\u0432\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TLS \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a Crowdstrike Falcon, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0442\u0438\u043f\u0430 \u00ab\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u043f\u043e\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435\u00bb",
  "\u041d\u0430\u043b\u0438\u0447\u0438\u0435 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u0430": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "\u041e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430 (CWE-296)",
  "\u041e\u043f\u0438\u0441\u0430\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u0430 TLS \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b \u043a\u043e\u043d\u0435\u0447\u043d\u044b\u0445 \u0442\u043e\u0447\u0435\u043a Crowdstrike Falcon \u0441\u0432\u044f\u0437\u0430\u043d\u0430 \u0441 \u043e\u0442\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u0435\u043c \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u043d\u0438\u044f \u0446\u0435\u043f\u043e\u0447\u043a\u0438 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043f\u0440\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0435 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u0430. \u042d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u043d\u0430\u0440\u0443\u0448\u0438\u0442\u0435\u043b\u044e, \u0434\u0435\u0439\u0441\u0442\u0432\u0443\u044e\u0449\u0435\u043c\u0443 \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u0442\u0438\u043f\u0430 \u00ab\u0447\u0435\u043b\u043e\u0432\u0435\u043a \u043f\u043e\u0441\u0435\u0440\u0435\u0434\u0438\u043d\u0435\u00bb",
  "\u041f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": null,
  "\u041f\u0440\u043e\u0447\u0430\u044f \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044f": null,
  "\u0421\u0432\u044f\u0437\u044c \u0441 \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0430\u043c\u0438 \u0418\u0411": "\u0414\u0430\u043d\u043d\u044b\u0435 \u0443\u0442\u043e\u0447\u043d\u044f\u044e\u0442\u0441\u044f",
  "\u0421\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043d\u0430",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f": "\u041e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u0433\u043e \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f",
  "\u0421\u043f\u043e\u0441\u043e\u0431 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438": "\u041c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0430\u043c\u0438 \u0434\u0430\u043d\u043d\u044b\u0445",
  "\u0421\u0441\u044b\u043b\u043a\u0438 \u043d\u0430 \u0438\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438": "https://nvd.nist.gov/vuln/detail/CVE-2025-1146\nhttps://www.crowdstrike.com/security-advisories/cve-2025-1146/\nhttps://vulners.com/cve/CVE-2025-1146",
  "\u0421\u0442\u0430\u0442\u0443\u0441 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u041f\u043e\u0434\u0442\u0432\u0435\u0440\u0436\u0434\u0435\u043d\u0430 \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0435\u043c",
  "\u0422\u0438\u043f \u041f\u041e": "\u041f\u0440\u0438\u043a\u043b\u0430\u0434\u043d\u043e\u0435 \u041f\u041e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c",
  "\u0422\u0438\u043f \u043e\u0448\u0438\u0431\u043a\u0438 CWE": "CWE-296",
  "\u0423\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438": "\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 2.0 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 7,6)\n\u0412\u044b\u0441\u043e\u043a\u0438\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 (\u0431\u0430\u0437\u043e\u0432\u0430\u044f \u043e\u0446\u0435\u043d\u043a\u0430 CVSS 3.1 \u0441\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 8,1)"
}

CVE-2025-1146 (GCVE-0-2025-1146)

Vulnerability from cvelistv5 – Published: 2025-02-12 18:27 – Updated: 2025-02-12 19:40

Title

CrowdStrike Falcon Sensor for Linux TLS Issue

Summary

CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. Windows and Mac sensors are not affected by this.

Severity

8.1 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-02-12 19:40 UTC

CWE

CWE-296 - Improper Following of a Certificate's Chain of Trust

Assigner

CrowdStrike mitre root Scorecard

References

1 reference

URL	Tags
https://www.crowdstrike.com/security-advisories/c…

Impacted products

3 products

Vendor	Product	Version
CrowdStrike	Falcon sensor for Linux	Unaffected: 7.21.17405 (semver) Affected: 7.20 , < 7.20.17308 (semver) Affected: 7.19 , < 7.19.17221 (semver) Affected: 7.18 , < 7.18.17131 (semver) Affected: 7.17 , < 7.17.17014 (semver) Affected: 7.16 , < 7.16.16909 (semver) Affected: 7.15 , < 7.15.16806 (semver) Affected: 7.14 , < 7.14.16705 (semver) Affected: 7.13 , < 7.13.16606 (semver) Affected: 7.11 , < 7.11.16410 (semver) Affected: 7.10 , < 7.10.16321 (semver) Affected: 7.07 , < 7.07.16209 (semver) Affected: 7.06 , < 7.06.16113 (semver)
CrowdStrike	Falcon Kubernetes Admission Controller	Unaffected: 7.21.1904 (semver) Affected: 7.20 , < 7.20.1808 (semver) Affected: 7.18 , < 7.18.1605 (semver) Affected: 7.17 , < 7.17.1503 (semver) Affected: 7.16 , < 7.16.1403 (semver) Affected: 7.14 , < 7.14.1203 (semver) Affected: 7.13 , < 7.13.1102 (semver) Affected: 7.12 , < 7.12.1002 (semver) Affected: 7.11 , < 7.11.904 (semver) Affected: 7.10 , < 7.10.806 (semver) Affected: 7.06 , < 7.06.603 (semver)
CrowdStrike	Falcon Container Sensor	Unaffected: 7.21.6003 (semver) Affected: 7.20 , < 7.20.5908 (semver) Affected: 7.19 , < 7.19.5807 (semver) Affected: 7.18 , < 7.18.5705 (semver) Affected: 7.17 , < 7.17.5603 (semver) Affected: 7.16 , < 7.16.5503 (semver) Affected: 7.15 , < 7.15.5403 (semver) Affected: 7.14 , < 7.14.5306 (semver) Affected: 7.13 , < 7.13.5202 (semver) Affected: 7.12 , < 7.12.5102 (semver) Affected: 7.11 , < 7.11.5003 (semver) Affected: 7.10 , < 7.10.4907 (semver) Affected: 7.06 , < 7.06.4705 (semver)

Date Public

2025-02-12 18:27

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-1146",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-12T19:40:26.132160Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-12T19:40:41.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "packageName": "falcon-sensor",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon sensor for Linux",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.17405",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.17308",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.19.17221",
              "status": "affected",
              "version": "7.19",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.17131",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.17014",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.16909",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.15.16806",
              "status": "affected",
              "version": "7.15",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.16705",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.16606",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.16410",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.16321",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.07.16209",
              "status": "affected",
              "version": "7.07",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.16113",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon Kubernetes Admission Controller",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.1904",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.1808",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.1605",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.1503",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.1403",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.1203",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.1102",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.12.1002",
              "status": "affected",
              "version": "7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.904",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.806",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.603",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unknown",
          "platforms": [
            "Linux"
          ],
          "product": "Falcon Container Sensor",
          "vendor": "CrowdStrike",
          "versions": [
            {
              "status": "unaffected",
              "version": "7.21.6003",
              "versionType": "semver"
            },
            {
              "lessThan": "7.20.5908",
              "status": "affected",
              "version": "7.20",
              "versionType": "semver"
            },
            {
              "lessThan": "7.19.5807",
              "status": "affected",
              "version": "7.19",
              "versionType": "semver"
            },
            {
              "lessThan": "7.18.5705",
              "status": "affected",
              "version": "7.18",
              "versionType": "semver"
            },
            {
              "lessThan": "7.17.5603",
              "status": "affected",
              "version": "7.17",
              "versionType": "semver"
            },
            {
              "lessThan": "7.16.5503",
              "status": "affected",
              "version": "7.16",
              "versionType": "semver"
            },
            {
              "lessThan": "7.15.5403",
              "status": "affected",
              "version": "7.15",
              "versionType": "semver"
            },
            {
              "lessThan": "7.14.5306",
              "status": "affected",
              "version": "7.14",
              "versionType": "semver"
            },
            {
              "lessThan": "7.13.5202",
              "status": "affected",
              "version": "7.13",
              "versionType": "semver"
            },
            {
              "lessThan": "7.12.5102",
              "status": "affected",
              "version": "7.12",
              "versionType": "semver"
            },
            {
              "lessThan": "7.11.5003",
              "status": "affected",
              "version": "7.11",
              "versionType": "semver"
            },
            {
              "lessThan": "7.10.4907",
              "status": "affected",
              "version": "7.10",
              "versionType": "semver"
            },
            {
              "lessThan": "7.06.4705",
              "status": "affected",
              "version": "7.06",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.20.17308",
                  "versionStartIncluding": "7.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.19.17221",
                  "versionStartIncluding": "7.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.18.17131",
                  "versionStartIncluding": "7.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.17.17014",
                  "versionStartIncluding": "7.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.16.16909",
                  "versionStartIncluding": "7.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.15.16806",
                  "versionStartIncluding": "7.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.14.16705",
                  "versionStartIncluding": "7.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.13.16606",
                  "versionStartIncluding": "7.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.11.16410",
                  "versionStartIncluding": "7.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.10.16321",
                  "versionStartIncluding": "7.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.07.16209",
                  "versionStartIncluding": "7.07",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:crowdstrike:falcon:*:*:*:*:*:linux:*:*",
                  "versionEndExcluding": "7.06.16113",
                  "versionStartIncluding": "7.06",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ],
          "operator": "AND"
        }
      ],
      "datePublic": "2025-02-12T18:27:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\u003cbr\u003e\u003cbr\u003e \u003cbr\u003eCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \u003cbr\u003e\u003cbr\u003e\u003cbr\u003eWindows and Mac sensors are not affected by this.\u003cbr\u003e\u003cbr\u003e"
            }
          ],
          "value": "CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above.\n\n \nCrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. \n\n\nWindows and Mac sensors are not affected by this."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-94",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-94 Adversary in the Middle (AiTM)"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-296",
              "description": "CWE-296: Improper Following of a Certificate\u0027s Chain of Trust",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-02-12T18:48:50.205Z",
        "orgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
        "shortName": "CrowdStrike"
      },
      "references": [
        {
          "url": "https://www.crowdstrike.com/security-advisories/cve-2025-1146/"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "CrowdStrike Falcon Sensor for Linux TLS Issue",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13ddcd98-6f4a-40a8-8e24-29ca0aee4661",
    "assignerShortName": "CrowdStrike",
    "cveId": "CVE-2025-1146",
    "datePublished": "2025-02-12T18:27:35.458Z",
    "dateReserved": "2025-02-10T03:03:51.392Z",
    "dateUpdated": "2025-02-12T19:40:41.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

BDU:2025-09075 (CVE-2025-1146)

CVE-2025-1146 (GCVE-0-2025-1146)

Tags

Sightings

Nomenclature

Related by attack behaviour