CVE-2025-32802CWE-379CWE-73

Insecure handling of file paths allows multiple local attacks

Medium · published May 28, 2025

CVSS v3.1
6.1
EPSS
0%
Percentile
11.5
In the wild
Unconfirmed
What it is

Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.

This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00216 · 11.5th percentile
Weaknesses
CWE-379 · Creation of Temporary File in Directory with Insecure Permissions; CWE-73 · External Control of File Name or Path
Published
2025-05-28T17:08Z
EPSS history
Timeline
  • 28 MAY 17:08Z
    Insecure handling of file paths allows multiple local attacks
    cvelistv5