CVE-2025-59353 - CVE House

Back to Database

Status published High CVE-2025-59353

Manager generates mTLS certificates for arbitrary IP addresses

7.7 CVSS

Vulnerability Description

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, a peer can obtain a valid TLS certificate for arbitrary IP addresses, effectively rendering the mTLS authentication useless. The issue is that the Manager’s Certificate gRPC service does not validate if the requested IP addresses “belong to” the peer requesting the certificate—that is, if the peer connects from the same IP address as the one provided in the certificate request. This vulnerability is fixed in 2.1.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59353

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from dragonflyoss

View All →

Dragonfly tiny file download uses hard coded HTTP protocol

Dragonfly has weak integrity checks for downloaded files

Dragonfly allows arbitrary file read and write on a peer machine

Dragonfly possibly panics due to nil pointer dereference when using variables created alongside an error

Timing attacks against Proxy’s basic authentication are possible

Affected Vendor

dragonflyoss

View all reports →

Affected Software

dragonfly

Vulnerable Versions:

< 2.1.0

Timeline

Official Publish: September 17th, 2025

Last Modified: September 18th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-295 CWE-862

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle

Credential Access

T1040 Network Sniffing

T1552 Unsecured Credentials

Credential Access

T1071 Application Layer Protocol

Command and Control

T1565 Data Manipulation

T1190 Exploit Public-Facing Application

T1068 Exploitation for Privilege Escalation

Privilege Escalation

T1078 Valid Accounts

T1531 Account Access Removal