Read the docs
TI-2026-35537 Aliases CVE-2026-48097

NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution

Priority LOW 35CWE-476Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service, Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-476 and CWE-78.

Summary

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 have a command execution vulnerability due to unsafe use of `shell=True` with commands that rely on executable resolution through the `PATH` environment variable. An attacker controlling the execution environment can place malicious executables such as sudo earlier in the `PATH`, resulting in execution of attacker-controlled code. Version 2.0.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00227 13th percentileScored 2026-11-07
Fix Fixed NexTOR_IP_CHANGER (0x5t4l1n): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0x5t4l1nNexTOR_IP_CHANGERbefore 2.0.02.0.0Patch availableCNA
  • NexTOR_IP_CHANGER Vendor0x5t4l1n Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

Remediation

  • Fix · CNA NexTOR_IP_CHANGER (0x5t4l1n) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48097

References

Other 2

  • TI-2026-35538 NexTOR IP Changer Unsafely Uses sudo and shell=True CVSS 3.1HIGH 7.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences