Medium

Predictable WebSocket masking in curl leading to proxy cache poisoning

IdentifiersCVE-2025-10148CWE-340

CVE-2025-10148 is a vulnerability in curl's WebSocket implementation where the client failed to update the required 32-bit masking key for each new outgoing frame. Instead of generating a fresh mask per frame as required by the WebSocket specification, curl reused a fixed mask value for the duration of the connection. This makes the masking pattern predictable. A malicious WebSocket server can exploit this predictability to induce traffic between the communicating parties that may be interpreted by an involved configured or transparent proxy as legitimate HTTP traffic, enabling cache poisoning. The issue is described as affecting Siemens COMOS V10.4.5 versions prior to 10.4.5.0.2 and COMOS V10.6 through its inclusion of the vulnerable curl component.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a malicious server to cause intermediary proxies to misinterpret crafted WebSocket traffic as genuine HTTP content and poison the proxy cache. Poisoned cached content could then be served to other users behind the same proxy. Based on the provided content, the primary security impact is integrity compromise of cached content and limited confidentiality exposure through proxy-mediated content substitution; no direct code execution or privilege escalation is described.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, reduce exposure to untrusted or attacker-controlled WebSocket servers, especially in environments where traffic traverses configured or transparent HTTP proxies with caching behavior. Limit outbound connectivity from affected systems, avoid routing such traffic through shared caching proxies where feasible, and apply standard network-segmentation and exposure-reduction controls. In ICS environments, Siemens/CISA guidance to minimize network exposure, isolate control networks, and use secure remote-access paths remains applicable.

Remediation

Patch, then assume compromise.

Update affected products to vendor-fixed versions. Based on the provided content, Siemens COMOS V10.4.5 should be updated to version 10.4.5.0.2 or later, and fixes are indicated for affected COMOS branches through Siemens advisories. More generally, deploy a curl version in which the WebSocket implementation generates a new 32-bit mask for each outgoing frame in accordance with the specification.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

HaxxCurlapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

16 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.

16 SOURCESView more in app

No news coverage yet. Advisories and community discussion only.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity15