CVEvulnerability

CVE-2025-32802

6.1 MEDIUM Published 2025-05-28 Modified 2026-06-17 Official page ↗
Status
Deferred
Published
2025-05-28
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.1 MEDIUM — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Weaknesses
CWE-379, CWE-73

Description

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Related

Weakness · CWE (2)

  • CWE-379 Creation of Temporary File in Directory with Insecure Permissions weakness
  • CWE-73 External Control of File Name or Path weakness

References