CVE-2025-32803: Insecure file permissions can result in confidential information leakage
In some cases, Kea log files or lease files may be world-readable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Keato a version that resolves this vulnerability.Fixed in 2.4.2 - Upgrade
Upgrade
Keato a version that resolves this vulnerability.Fixed in 2.6.3 - Upgrade
Upgrade
Keato a version that resolves this vulnerability.Fixed in 2.7.9
Event History
Frequently Asked Questions
What is the severity of CVE-2025-32803?
CVE-2025-32803 is considered a medium severity vulnerability due to the potential exposure of sensitive log and lease files.
How do I fix CVE-2025-32803?
To fix CVE-2025-32803, ensure that the permissions on Kea log files and lease files are set to restrict access to authorized users only.
Which versions of Kea are affected by CVE-2025-32803?
CVE-2025-32803 affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
What are the potential risks associated with CVE-2025-32803?
The risks of CVE-2025-32803 include unauthorized access to sensitive data contained in log and lease files, which could lead to further exploitation.
Is there a known exploit for CVE-2025-32803?
As of now, there is no publicly available information confirming an exploit specifically targeting CVE-2025-32803.