{"id":"CVE-2025-62514","aliases":["EUVD-2025-206513","GHSA-hrc9-gm58-pgj9"],"status":"published","title":"`libparsec_crypto` does not check for weak order point of curve 25519","description":"Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.","severity":{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00302,"percentile":0.23214,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-1240","CWE-327"],"published":"2026-01-29T15:46:50Z","modified":"2026-10-28T02:30:55Z","products":[{"vendor":"parsec.cloud","product":"parsec"},{"vendor":"scille","product":"parsec-cloud"}],"references":[{"url":"https://github.com/Scille/parsec-cloud/security/advisories/GHSA-hrc9-gm58-pgj9","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory"]},{"url":"https://github.com/Scille/parsec-cloud/commit/197bb6387b49fec872b5e4a04dcdb82b3d2995b2","tags":["x_refsource_MISC","Patch","fix"]},{"url":"https://github.com/Scille/parsec-cloud/blob/e7c5cdbc4234f606ccf3ab2be7e9edc22db16feb/libparsec/crates/crypto/src/rustcrypto/private.rs#L136-L138","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/curve25519-dalek/src/montgomery.rs#L132-L146","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/dalek-cryptography/curve25519-dalek/blob/8c53a8f10b146a2fd65069437e3576e49b390e7a/x25519-dalek/src/x25519.rs#L364-L366","tags":["x_refsource_MISC","Patch","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62514.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-62514","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-62514","title":"`libparsec_crypto` does not check for weak order point of curve 25519","description":"Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.","status":"published","published":"2026-01-29T15:46:50.922Z","modified":"2026-01-29T21:29:03.456Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-327","CWE-1240"],"updated_at":"2026-11-02T14:32:54.534202Z"}],"euvd":[{"id":"EUVD-2025-206513","description":"Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.","status":"published","published":"2026-01-29T15:46:50Z","modified":"2026-01-29T21:29:03Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T19:48:45.464917Z"}],"nvd":[{"id":"CVE-2025-62514","description":"Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.","status":"published","published":"2026-01-29T16:16:09.387Z","modified":"2026-06-17T09:52:01.117Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high","assessor":"primary"}],"cwes":["CWE-327","CWE-1240"],"updated_at":"2026-11-02T14:11:59.073638Z"}],"osv":[{"id":"CVE-2025-62514","title":"`libparsec_crypto` does not check for weak order point of curve 25519","description":"Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.","status":"published","published":"2026-01-29T15:46:50.922Z","modified":"2026-10-28T02:30:55.916685527Z","cvss":[{"version":"3.1","score":8.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-1240","CWE-327"],"updated_at":"2026-11-02T15:44:51.851511Z"}]}}