CVE-2025-62514: 
NixOS vulnerability analysis and mitigation

CVE-2025-62514 is a cryptographic weakness in libparsec_crypto, the cryptographic component of the Parsec cloud-based secure file sharing application. When compiled with the RustCrypto backend, the component fails to validate weak order (non-contributory) points of Curve25519 during Diffie-Hellman key exchange, enabling a man-in-the-middle (MITM) attacker to subvert the SAS (Short Authentication String) verification mechanism. Affected versions span the entire 3.x branch from 3.0.0 up to (but not including) 3.6.0; only Parsec web is impacted, as Parsec desktop uses the libsodium backend which is unaffected. The vulnerability was published on January 29, 2026, and carries a CVSS v3.1 base score of 7.1 (High) per NVD, or 8.3 (High) per the GitHub Security Advisory (GitHub Advisory, Red Hat CVE).

The root cause is classified under CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-1240 (Use of a Cryptographic Primitive with a Risky Implementation). Specifically, the PrivateKey::generate_shared_secret_key function in libparsec/crates/crypto/src/rustcrypto/private.rs called the bare x25519() function from the x25519-dalek crate, which performs MontgomeryPoint::mul_clamped without checking whether the resulting shared secret is the identity point (all-zeros), i.e., it does not call was_contributory() on the result (GitHub Advisory, Vulnerable Code). An attacker in a MITM position can supply weak-order (e.g., all-zero) Curve25519 public key points to both communicating parties; because the scalar multiplication of any value by a low-order point yields a predictable result (typically zero), both parties independently derive the same shared key — a value also known to the attacker. This causes the SAS code exchange to succeed, falsely indicating to both parties that no MITM is present (x25519-dalek source).

A successful exploit allows an attacker with a MITM network position to silently intercept and decrypt all communications between Parsec web users, with high probability of both parties deriving the same attacker-known shared key. The SAS verification — the primary mechanism for users to detect MITM attacks — is rendered ineffective, meaning both parties are misled into believing the session is secure. This results in high confidentiality and integrity impact (the attacker can read and potentially modify encrypted file-sharing traffic), with a low availability impact, and the compromise is undetectable by end users (GitHub Advisory).

A proof-of-concept reference is available via the GitHub Security Advisory, though no evidence of active in-the-wild exploitation has been reported as of the disclosure date (GitHub Advisory). Exploitation requires the attacker to be in a network MITM position and to have low-level privileges (authenticated user context), making it a moderately complex attack. The EPSS score is approximately 0.025% (0.000250), indicating a low probability of near-term automated exploitation. This CVE is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was discovered and reported by Oppida and Corentin Le Coz (GitHub Advisory).

1. Reconnaissance: Identify Parsec web deployments running versions 3.0.0–3.5.x. Parsec desktop users are not affected.
2. Establish MITM position: Position between two Parsec web users during an invitation/key exchange session (e.g., via ARP spoofing, DNS poisoning, or rogue network access point).
3. Intercept key exchange: Capture the Diffie-Hellman public key exchange messages between the two parties (claimer and greeter) during the Parsec invitation flow.
4. Inject weak-order points: Replace each party's legitimate Curve25519 public key with a weak-order point (e.g., the all-zero point 0x0000...0000) before forwarding to the other party.
5. Force predictable shared secret: Because libparsec_crypto's RustCrypto backend does not check for non-contributory results, both parties compute the same predictable shared key (e.g., all-zeros) from the injected weak points — a value the attacker also knows.
6. Bypass SAS verification: The shared key derived by both parties matches, causing the SAS code exchange to succeed and misleading both parties into believing no MITM is present.
7. Decrypt communications: Using the known shared key, the attacker can decrypt, monitor, or modify all subsequent encrypted file-sharing traffic between the two parties (GitHub Advisory, Patch Commit).

• Network: Unexpected modification or substitution of Curve25519 public key bytes (e.g., all-zero 32-byte values 0x0000000000000000000000000000000000000000000000000000000000000000) in Parsec web invitation/key exchange traffic; anomalous ARP or DNS responses redirecting Parsec web traffic through an intermediate host.
• Logs: Parsec server or proxy logs showing invitation flows where both parties' public keys appear identical or are all-zeros; repeated invitation attempts from the same IP with varying public key values.
• Application Behavior: SAS code verification succeeding despite users reporting they did not visually confirm the SAS codes out-of-band; unexpected shared secret key errors (CryptoError::SharedSecretKey) appearing in updated (patched) deployments, which would indicate attempted exploitation against a patched instance.
• File System: No specific file artifacts are expected, as this is a network-layer cryptographic attack with no persistent host-level indicators (GitHub Advisory).

Upgrade all Parsec web deployments to version 3.6.0 or later, which adds a contributory check using StaticSecret::diffie_hellman and SharedSecret::was_contributory() to reject weak-order points (Patch Commit). Parsec desktop users are not affected and require no action for this specific vulnerability. As a temporary network-level mitigation, implement strict transport layer security (TLS) controls and network segmentation to reduce exposure to MITM attacks. Review any file-sharing sessions conducted through affected Parsec web instances (versions 3.0.0–3.5.x) for potential compromise, particularly those where SAS verification was performed (GitHub Advisory).

The vulnerability was acknowledged by the Parsec (Scille) team via a GitHub Security Advisory published January 29, 2026, crediting Oppida and Corentin Le Coz for discovery (GitHub Advisory). Brief social media coverage appeared on Mastodon and Bluesky shortly after disclosure, primarily from automated CVE tracking accounts. Red Hat also tracked the CVE in their security database (Red Hat CVE). No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator postings.