{"id":56157,"date":"2025-06-30T23:45:52","date_gmt":"2025-06-30T23:45:52","guid":{"rendered":""},"modified":"2025-08-31T18:38:19","modified_gmt":"2025-09-01T00:38:19","slug":"cve-2025-52572-critical-vulnerability-in-hikka-telegram-userbot","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-52572-critical-vulnerability-in-hikka-telegram-userbot\/","title":{"rendered":"CVE-2025-52572: Critical Vulnerability in Hikka Telegram Userbot<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

The Common Vulnerabilities and Exposures (CVE) system has identified a severe vulnerability, CVE-2025-52572, affecting all versions of the popular Telegram userbot, Hikka. This vulnerability has the potential to compromise entire systems and leak sensitive data, making it a pressing concern for all Hikka users. With a CVSS severity score of 10.0, the maximum possible, it represents a significant threat to the security<\/a> and privacy of users and their data.
\nThe vulnerability lies in the Hikka bot’s web<\/a> interface and can be exploited in two distinct scenarios. The first scenario occurs when the web interface lacks an authenticated session, allowing an attacker to use their Telegram account to gain remote code execution<\/a> (RCE) to the server. The second scenario involves an authenticated session, where a lack of sufficient warning in the authentication message tempts users to allow<\/a> potentially damaging actions.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-52572
\nSeverity: Critical (10.0 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise and data<\/a> leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Hikka (Telegram Userbot) | All Versions<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The exploit takes advantage of flaws in Hikka’s web interface. In the first scenario, if the interface lacks an authenticated session, an attacker can use their Telegram<\/a> account to authorize in the dangling web interface and gain RCE to the server. In the second scenario, with an authenticated session, an attacker can manipulate users into allowing<\/a> potentially harmful actions due to insufficient warning in the authentication message. This not only enables RCE but also grants the attacker access to the Telegram<\/a> accounts of the owners.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Given the nature of this vulnerability, a conceptual example would involve an attacker using their own Telegram account to authorize in the dangling web interface of an unsecured Hikka userbot. This could potentially look something like this:<\/p>\n

import telebot\nbot = telebot.TeleBot('YOUR_BOT_TOKEN')\n@bot.message_handler(commands=['start'])\ndef send_welcome(message):\nbot.reply_to(message, \"Hello, I am the attacker's bot. You just allowed me to execute remote code on your server.\")\nbot.polling()<\/code><\/pre>\n
In this conceptual example, the attacker’s bot sends a welcome message to the user, indicating that the user has unknowingly given the bot permission to execute remote code<\/a>. The actual exploit would be far more complex and malicious, but this provides a basic idea of how the vulnerability<\/a> could be exploited.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview The Common Vulnerabilities and Exposures (CVE) system has identified a severe vulnerability, CVE-2025-52572, affecting all versions of the popular Telegram userbot, Hikka. This vulnerability has the potential to compromise entire systems and leak sensitive data, making it a pressing concern for all Hikka users. With a CVSS severity score of 10.0, the maximum possible, […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-56157","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t