← Back

CVE-2025-13476

nvd nist
Published: Mar 5, 2026Modified: Mar 10, 2026

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Rakuten Viber Cloak mode in Android v25.7.2.0g and Windows v25.6.0.0–v25.8.1.0 uses a static and predictable TLS ClientHello fingerprint lacking extension diversity, allowing Deep Packet Inspection (DPI) systems to trivially identify and block proxy traffic, undermining censorship circumvention. (CWE-327)

Affected (2)

Products: Rakuten: Viber
Rakuten
1 product
Viber
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Rakuten
Viber
From 25.6.0 to 25.8.1.0
Viber
Version 9.3.0.6 25.7.2.0g

Related CWEs

CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The product uses a broken or risky cryptographic algorithm or protocol.

References (2)

Source: cret@cert.org
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory

Timeline

No history available yet.