Read the docs
TI-2026-35538 Aliases CVE-2026-48098

NexTOR IP Changer Unsafely Uses sudo and shell=True

Priority LOW 33CWE-250Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation, Code execution
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-250 and CWE-78.

Summary

NexTor IP Changer is a command-line tool that leverages the Tor network to periodically rotate a user's IP address. Versions prior to 2.0.0 execute privileged system commands using `sudo` and `shell=True` directly inside application logic. In environments where passwordless sudo (`NOPASSWD`) is enabled, privileged commands may execute silently without explicit user confirmation. Version 2.0.0 fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00193 8th percentileScored 2026-11-07
Fix Fixed NexTOR_IP_CHANGER (0x5t4l1n): 2.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
0x5t4l1nNexTOR_IP_CHANGERbefore 2.0.02.0.0Patch availableCNA
  • NexTOR_IP_CHANGER Vendor0x5t4l1n Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

Remediation

  • Fix · CNA NexTOR_IP_CHANGER (0x5t4l1n) Fixed in 2.0.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48098

References

Other 1

  • TI-2026-35537 NexTOR_IP_CHANGER has PATH Injection Leading to Arbitrary Command Execution CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences