Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LSummary
CVE-2025-62514 is a high-severity Use of a Broken or Risky Cryptographic Algorithm (CWE-327) vulnerability in Parsec.Cloud Parsec. Its CVSS base score is 8.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Weaken Encryption (T1600); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-62514 is a cryptographic vulnerability in Parsec, a cloud-based application for secure file sharing. It affects versions on the 3.x branch prior to 3.6.0, specifically the libparsec_crypto component when compiled with the RustCrypto backend. The flaw arises because libparsec_crypto does not validate for weak order points on the Curve25519 elliptic curve. Only the Parsec web application is impacted, as the desktop version uses the libsodium backend instead.
An attacker in a man-in-the-middle (MITM) position can exploit this during the Diffie-Hellman key exchange by supplying weak order points to both communicating parties. This leads to a high probability that both parties derive the identical shared key, which the attacker also knows. As a result, the Short Authenticated String (SAS) code exchange succeeds, falsely assuring both parties that no MITM is present and enabling the attacker to decrypt and potentially tamper with communications.
Parsec version 3.6.0 patches the issue by adding proper checks for weak order points in the RustCrypto backend, as detailed in the commit at https://github.com/Scille/parsec-cloud/commit/197bb6387b49fec872b5e4a04dcdb82b3d2995b2 and the security advisory at https://github.com/Scille/parsec-cloud/security/advisories/GHSA-hrc9-gm58-pgj9. Affected users should upgrade to 3.6.0 or later, with code references highlighting the fix in libparsec_crypto's private.rs and related curve25519-dalek dependencies.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-206513
Vulnerability Data
Parsec is a cloud-based application for cryptographically secure file sharing. In versions on the 3.x branch prior to 3.6.0, `libparsec_crypto`, a component of the Parsec application, does not check for weak order point of Curve25519 when compiled with its RustCrypto…
more
backend. In practice this means an attacker in a man-in-the-middle position would be able to provide weak order points to both parties in the Diffie-Hellman exchange, resulting in a high probability to for both parties to obtain the same shared key (hence leading to a successful SAS code exchange, misleading both parties into thinking no MITM has occurred) which is also known by the attacker. Note only Parsec web is impacted (as Parsec desktop uses `libparsec_crypto` with the libsodium backend). Version 3.6.0 of Parsec patches the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 18 hardening rules · 8 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-13 requires selection and implementation of specific cryptography types, directly stopping use of broken algorithms.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require use of approved, proven cryptographic implementations and forbid risky custom ones.
PR.DS-01 promotes encryption for data-at-rest but never requires strong algorithms, leaving CWE-327 fully possible; the weakness is also far broader than data-at-rest so one narrow control removes none of its total risk.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandating approved algorithms, cipher strength and usage standards directly stops the selection of broken or weak cryptographic primitives that attackers can exploit.
Security testing can detect use of weak or non-compliant cryptographic primitives before deployment.
The explicit call-out of cryptography-related legal constraints (import/export, key escrow, digital-signature validity) reduces the likelihood that an organization will adopt broken or non-compliant cryptographic algorithms that violate those rules.
Access to current specialist guidance and early vulnerability alerts enables timely replacement of broken or risky cryptographic algorithms with stronger alternatives.
Secure SDLC requires vetted crypto libraries and standards, reducing risky custom implementations.
Application security requirements can specify approved cryptographic standards and disallow risky primitives.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (2 rules)
- V-248524 OL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-1240, CWE-327
- V-248534 OL 8 must employ FIPS 140-2 approved cryptographic hashing algorithms for all stored passwords. prevents CWE-1240
Oracle Linux 9 (1 rule)
- V-271628 OL 9 must employ FIPS 140-3 approved cryptographic hashing algorithms for all stored passwords. prevents CWE-1240
RHEL 8 (2 rules)
- V-230223 RHEL 8 must implement NIST FIPS-validated cryptography for the following: To provision digital signatures, to generate cryptographic hashes, and to protect data requiring data-at-rest protections in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. prevents CWE-1240
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-1240
Windows 10 (1 rule)
- V-220937 The system must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-327
Windows 11 (1 rule)
- V-253461 The system must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-327
Windows Server 2016 (1 rule)
- V-225053 Windows Server 2016 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-327
Windows Server 2019 (1 rule)
- V-205654 Windows Server 2019 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-327
Windows Server 2022 (1 rule)
- V-254474 Windows Server 2022 must be configured to prevent the storage of the LAN Manager hash of passwords. prevents CWE-327