Hikka vulnerable to RCE through dangling web interface

The impact of CVE-2025-52572 is severe. The primary attack vector involves exploiting an unauthenticated web interface, allowing an attacker to authorize their own Telegram account and gain RCE. A second, more insidious attack leverages social engineering. Users, tempted by a misleading authentication message, may inadvertently grant an attacker access to the web application's operations menu, resulting in both RCE and potential compromise of the owner's Telegram accounts. This represents a significant data breach risk, as Telegram accounts often contain sensitive personal information and communication history. Lateral movement within the compromised system is also possible, allowing attackers to pivot to other connected resources. The blast radius extends to all users of the affected Hikka instance and potentially their Telegram contacts.

1. आरक्षित2025-06-18
2. प्रकाशित2025-06-24
3. संशोधित2025-12-08
4. EPSS अद्यतन2026-03-23

The primary mitigation for CVE-2025-52572 is to immediately upgrade Hikka to version 1.7.1 or later. If upgrading is not immediately feasible, consider temporarily disabling the web interface to prevent unauthorized access. Implement strict user awareness training to educate users about the risks of clicking suspicious authentication prompts. While a Web Application Firewall (WAF) might offer some protection, it's unlikely to be effective against the social engineering aspect of the vulnerability. Monitor system logs for unusual activity, particularly authentication attempts from unfamiliar Telegram accounts. After upgrading, confirm the fix by attempting to access the web interface and verifying that authentication requires proper credentials.