CVE-2025-32802 MEDIUM

CVE-2025-32802: Insecure handling of file paths allows multiple local attacks

Vendor Isc

Product Kea

Weakness CWE-73

Published May 28, 2025

Last update May 28, 2025

View on NVD All CVEs

CVSS base score

6.1/10

Attack vector Local

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality None

Integrity Low

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

What the vulnerability does

01Description

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

Key dates

02Disclosure timeline

May 28, 2025 CVE published

May 28, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-32802 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/73.html

Identifiers

CVE CVE-2025-32802

CWE CWE-73

CVSS 6.1 / MEDIUM

Affected versions

Vendor Isc

Product Kea

Affected ≥ 2.4.0 and ≤ 2.4.1

Vendor Isc

Product Kea

Affected ≥ 2.6.0 and ≤ 2.6.2

Vendor Isc

Product Kea

Affected ≥ 2.7.0 and ≤ 2.7.8