What’s Vulnerable › Vulnerabilities

CVE-2018-25022

• Severity: low (CVSS 3.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-12-13 · updated 2026-06-17
• Weakness: CWE-200

Description

The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote attacker to discover a target user's IP address (when knowing only their Tox Id) by positioning themselves close to target's Tox Id in the DHT for the target to establish an onion connection with the attacker, guessing the target's DHT public key and creating a DHT node with public key close to it, and finally onion-routing a NAT Ping Request to the target, requesting it to ping the just created DHT node.

Affected products

• Toktok Toxcore: before 0.2.2 — fixed in 0.2.2

How to fix

Upgrade to a fixed version: Toktok Toxcore 0.2.2. Check the vendor advisory for mitigations.

References

• https://blog.tox.chat/2018/04/security-vulnerability-and-new-toxcore-release
• https://github.com/TokTok/c-toxcore/issues/873
• https://github.com/TokTok/c-toxcore/pull/872
• https://blog.tox.chat/2018/04/security-vulnerability-and-new-toxcore-release
• https://github.com/TokTok/c-toxcore/issues/873
• https://github.com/TokTok/c-toxcore/pull/872

Get alerted when CVE-2018-25022 or the next vulnerability affects your stack