CVE-2015-20112 Details
Description
RLPx 5 has two CTR streams based on the same key, IV, and nonce. This can facilitate decryption on a private network.
A vulnerability exists in the Ethereum RLPx protocol, specifically in version 5, where two AES CTR streams are generated from the same key, initialization vector (IV), and nonce. This flaw allows for a man-in-the-middle attack, where an attacker who knows one plaintext can decrypt other plaintexts encrypted with the reused keystream. This issue is particularly concerning on private networks, where the impact could be more pronounced.
Users can update to the patched version of the Go Ethereum client, which includes a fix for this vulnerability. Instructions for updating can be found in the Go Ethereum repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 29, 2025CISA-ADP
Assessed Jun 30, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ethereum/devp2p/blob/master/rlpx.md#known-issues-in-the-current-version | [email protected] | Technical DescriptionVendor |
| https://github.com/ethereum/devp2p/issues/32 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/ethereum/go-ethereum/issues/1315 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/hyperledger/besu/issues/7926 | [email protected] | Issue TrackingTechnical DescriptionVendor |
| https://github.com/LaurentMT/go-ethereum/commit/e8cba7283b57280b1bcf5761478f852398365901 | [email protected] | Source CodeVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-325 | Missing Cryptographic Step | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Ethereum RLPx | All versions |
CPE
Remediation
| |
| Ethereum go-ethereum | All versions |
CPE
Remediation | |
| Hyperledger Besu | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 29, 2025 | New CVE Received | [email protected] |