« Volver al listado

CVE-2025-32801

Estado: AplazadaAlta (7.8)—

Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

AV:L, PR:L, UI:N indica escalada local; CWE-94 (código arbitrario) + carga de biblioteca maliciosa permite ejecución de comandos con privilegios root cuando Kea se ejecuta como root.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Execution PreventionThreat Intelligence ProgramRestrict Web-Based ContentPrivileged Account ManagementLimit Software InstallationBehavior Prevention on Endpoint

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

ISC — KEAAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-32801",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-32801",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-28T17:33:36.266136Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-officer@isc.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "security-officer@isc.org",
      "affectedData": [
        {
          "vendor": "ISC",
          "product": "Kea",
          "versions": [
            {
              "status": "affected",
              "version": "2.4.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.4.1"
            },
            {
              "status": "affected",
              "version": "2.6.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.6.2"
            },
            {
              "status": "affected",
              "version": "2.7.0",
              "versionType": "custom",
              "lessThanOrEqual": "2.7.8"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-28T17:15:23.710",
  "references": [
    {
      "url": "https://kb.isc.org/docs/cve-2025-32801",
      "source": "security-officer@isc.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-officer@isc.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kea configuration and API directives can be used to load a malicious hook library.  Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.\nThis issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8."
    },
    {
      "lang": "es",
      "value": "La configuración de Kea y las directivas de la API pueden usarse para cargar una librería de ganchos maliciosa. Muchas configuraciones comunes ejecutan Kea como root, dejan los puntos de entrada de la API sin protección por defecto o ubican los sockets de control en rutas inseguras. Este problema afecta a las versiones de Kea 2.4.0 a 2.4.1, 2.6.0 a 2.6.2 y 2.7.0 a 2.7.8."
    }
  ],
  "lastModified": "2026-06-17T09:12:35.890",
  "sourceIdentifier": "security-officer@isc.org"
}