A critical vulnerability in the Sliver C2 framework allows unauthenticated attackers to cause a denial of service through memory exhaustion by exploiting improper authentication handling.

This vulnerability involves missing authentication for a critical function (CWE-306) and uncontrolled resource consumption (CWE-400). Unauthenticated remote actors can send bootstrap messages that bypass TOTP validation, leading to the allocation of server-side sessions that never expire.

Successful exploitation results in a denial of service for the command and control framework, rendering the infrastructure unresponsive. Given the CVSS score of 7.5, the high availability impact poses a significant risk to operations that rely on Sliver for secure communications, potentially causing critical downtime for managed security infrastructure.

Immediate Action: Update the BishopFox Sliver framework to version 1.7.0 or later to implement proper TOTP validation and session management.

Proactive Monitoring: Monitor server memory utilization and DNS listener logs for unusual spikes in session creation requests that may indicate an ongoing denial of service attempt.

Compensating Controls: Implement network-level access controls to restrict traffic to the DNS C2 listener to authorized IP ranges only, reducing the exposure of the vulnerable endpoint.

Public Exploit Available: Unknown

The risk associated with this vulnerability is significant due to the lack of authentication required to trigger the resource exhaustion. Security teams managing Sliver infrastructure must prioritize the update to version 1.7.0 immediately to prevent potential service disruption and ensure that TOTP enforcement functions as intended.