DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61554: CVE-2026-61554: Uncontrolled Resource Consumption in emp3r0r C2 http_poll Transport

#security #cve #cybersecurity

CVE-2026-61554: Uncontrolled Resource Consumption in emp3r0r C2 http_poll Transport

Vulnerability ID: CVE-2026-61554
CVSS Score: 7.5
Published: 2026-09-15

CVE-2026-61554 is a high-severity uncontrolled resource consumption vulnerability in the http_poll transport component of the emp3r0r Command and Control (C2) framework. In affected versions prior to 4.2.5, the C2 server allocates session tracking resources, spawns execution routines, and routes incoming unauthenticated request bodies into the core dispatch engine before verifying the client's cryptographic authentication token. This logical ordering flaw allows unauthenticated remote attackers to exhaust critical host system resources and trigger a sustained denial of service.

TL;DR

Unauthenticated pre-authentication resource allocation in the http_poll transport allows remote attackers to cause a Denial of Service (DoS) in the emp3r0r C2 server by sending floods of arbitrary HTTP requests.

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • Impact: Denial of Service (DoS)
  • Exploit Status: None/Unproven
  • CISA KEV Status: Not Listed

Affected Systems

  • emp3r0r Command and Control (C2) Server (versions prior to 4.2.5)
  • emp3r0r: < 4.2.5 (Fixed in: 4.2.5)

Mitigation Strategies

  • Upgrade emp3r0r to version 4.2.5 or later to enforce synchronous authentication validation.
  • Deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the C2 server to rate-limit incoming HTTP traffic.
  • Apply network-layer firewall rules or VPNs to restrict access to the C2 polling port to trusted IP blocks.

Remediation Steps:

  1. Navigate to the C2 server deployment environment and stop the active emp3r0r instance.
  2. Pull the updated repository tag or binary release for version 4.2.5 from the official repository.
  3. Recompile the server components using the updated source code.
  4. Deploy the updated binaries and verify that the http_poll transport is properly dropping unauthenticated requests before allocating worker resources.

References

Read the full report for CVE-2026-61554 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)