CVE-2025-32801: Loading a malicious hook library can lead to local privilege escalation
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32801?
CVE-2025-32801 has a high severity due to the potential for executing malicious hook libraries as root.
How do I fix CVE-2025-32801?
To fix CVE-2025-32801, upgrade to Kea versions 2.4.2, 2.6.3, or 2.7.9 or later.
What are the risks associated with CVE-2025-32801?
The risks include unauthorized access to the API and the ability for attackers to execute arbitrary code on the server.
Which versions of ISC Kea are affected by CVE-2025-32801?
Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8 are affected by CVE-2025-32801.
What configurations might expose CVE-2025-32801?
Commonly, configurations that run Kea as root, do not secure API entry points, or place control sockets in insecure paths may expose CVE-2025-32801.