Technical impact
Emp3r0r is a command‑and‑control tool written in Go that uses shared maps across goroutines. Prior to version 3.21.2, the tool does not guard concurrent reads and writes against these maps, creating a race condition that can trigger the Go runtime fatal error "concurrent map read and map write". When this occurs the C2 process panics and terminates, resulting in a loss of availability for the compromised host. This vulnerability is a classic race‑condition flaw (CWE‑362/CWE‑663).
Affected Systems
The bug appears in all releases of emp3r0r before v3.21.2. The affected product is the command‑and‑control framework developed by jm33-m0 (username). All systems running a vulnerable version are susceptible to crash under concurrent map access.
Risk and Exploitability
The CVSS score of 7 indicates high severity. EPSS is less than 1%, suggesting exploitation is unlikely but not impossible. The CWE identifiers point to a race condition that requires concurrent goroutine activity. Attackers would typically need to trigger a high‑concurrency scenario within the C2 process; external network traffic alone may not be sufficient. The vulnerability is not listed in the CISA KEV catalog, meaning no public exploits have been observed yet. The risk remains for systems running older emp3r0r versions that cannot be immediately patched.
Github GHSA