CVE-2025-32801

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

CVSS v3 7.8 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://kb.isc.org/docs/cve-2025-32801

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) La configuración de Kea y las directivas de la API pueden usarse para cargar una librería de ganchos maliciosa. Muchas configuraciones comunes ejecutan Kea como root, dejan los puntos de entrada de la API sin protección por defecto o ubican los sockets de control en rutas inseguras. Este problema afecta a las versiones de Kea 2.4.0 a 2.4.1, 2.6.0 a 2.6.2 y 2.7.0 a 2.7.8.

28 May 2025, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-05-28 17:15

Updated : 2026-06-17 09:12

NVD link : CVE-2025-32801

Mitre link : CVE-2025-32801

CVE.ORG link : CVE-2025-32801

JSON object : View

Products Affected

No product.

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-32801", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-32801", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-05-28T17:33:36.266136Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-officer@isc.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "affected": [{"source": "security-officer@isc.org", "affectedData": [{"vendor": "ISC", "product": "Kea", "versions": [{"status": "affected", "version": "2.4.0", "versionType": "custom", "lessThanOrEqual": "2.4.1"}, {"status": "affected", "version": "2.6.0", "versionType": "custom", "lessThanOrEqual": "2.6.2"}, {"status": "affected", "version": "2.7.0", "versionType": "custom", "lessThanOrEqual": "2.7.8"}], "defaultStatus": "unaffected"}]}], "published": "2025-05-28T17:15:23.710", "references": [{"url": "https://kb.isc.org/docs/cve-2025-32801", "source": "security-officer@isc.org"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-officer@isc.org", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.\nThis issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8."}, {"lang": "es", "value": "La configuraci\u00f3n de Kea y las directivas de la API pueden usarse para cargar una librer\u00eda de ganchos maliciosa. Muchas configuraciones comunes ejecutan Kea como root, dejan los puntos de entrada de la API sin protecci\u00f3n por defecto o ubican los sockets de control en rutas inseguras. Este problema afecta a las versiones de Kea 2.4.0 a 2.4.1, 2.6.0 a 2.6.2 y 2.7.0 a 2.7.8."}], "lastModified": "2026-06-17T09:12:35.890", "sourceIdentifier": "security-officer@isc.org"}