Log in Start free

Vulnerability · Published May 28, 2025 · Assigned by isc

CVE-2025-32802Insecure handling of file paths allows multiple local attacks

Medium 6.1

In plain English

A medium-severity security flaw in Kea from ISC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.2%top 86.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10kea-doc2.6.3-1.el10_0ALSA-2025:9178
Alpine:v3.22kea2.6.3-r0ALPINE-CVE-2025-32802
Alpine:v3.23kea2.6.3-r0ALPINE-CVE-2025-32802
Alpine:v3.24kea2.6.3-r0ALPINE-CVE-2025-32802
Debian:12isc-keano fix listedDEBIAN-CVE-2025-32802
Debian:13isc-kea2.6.3-1DEBIAN-CVE-2025-32802
Debian:14isc-kea2.6.3-1DEBIAN-CVE-2025-32802
Rocky Linux:10kea0:2.6.3-1.el10_0RLSA-2025:9178
Ubuntu:24.04:LTSisc-keano fix listedUBUNTU-CVE-2025-32802
Ubuntu:25.10isc-kea2.6.3-1UBUNTU-CVE-2025-32802

Affected products (as reported)

VendorProductVersions
ISC Kea 2.4.0 – through 2.4.12.6.0 – through 2.6.22.7.0 – through 2.7.8

Weakness: CWE-73, CWE-379 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

References