CVE-2025-62820

MediumCVSS 4.9/10Last modified Oct 8, 2026

Description

Slack Nebula before 1.9.7 mishandles CIDR in some configurations and thus accepts arbitrary source IP addresses within the Nebula network.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-420

Affected software

VendorProductVersions
SlackNebula< 1.9.7

References

Timeline

Published
Oct 23, 2025
Last modified
Oct 8, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-628219.1Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving tCVE-2025-628264.3An Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability [CWE-113] vulnerability in Fortinet FCVE-2025-62837.5A vulnerability was found in xataio Xata Agent up to 0.3.0. It has been classified as problematic. This affects the function GET of the fileCVE-2025-62844.3A vulnerability was found in PHPGurukul Car Rental Portal 3.0. It has been declared as problematic. This vulnerability affects unknown code.CVE-2025-628403.3A generation of error message containing sensitive information vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attCVE-2025-628427.8An external control of file name or path vulnerability has been reported to affect HBS 3 Hybrid Backup Sync. If an attacker gains local netwCVE-2025-628436.8An improper restriction of communication channel to intended endpoints vulnerability has been reported to affect QHora. If an attacker gainsCVE-2025-628445.5A weak authentication vulnerability has been reported to affect QHora. If an attacker gains local network access, they can then exploit the CVE-2025-628456.7An improper neutralization of escape, meta, or control sequences vulnerability has been reported to affect QHora. If a local attacker gains CVE-2025-628466.7An SQL injection vulnerability has been reported to affect QHora. If a local attacker gains an administrator account, they can then exploit CVE-2025-628477.5An improper neutralization of argument delimiters in a command vulnerability has been reported to affect several QNAP operating system versiCVE-2025-628487.5A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then e
CVE-2025-62820: Medium severity, CVSS 4.9 | Vulnix