CVE-2025-62525

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-62525", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-15T15:03:28.135Z", "datePublished": "2025-10-22T14:59:15.265Z", "dateUpdated": "2025-10-22T17:24:17.273Z"}, "containers": {"cna": {"title": "OpenWrt vulnerable to local privilage escalation", "problemTypes": [{"descriptions": [{"cweId": "CWE-20", "lang": "en", "description": "CWE-20: Improper Input Validation", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-787", "lang": "en", "description": "CWE-787: Out-of-bounds Write", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr"}, {"name": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e", "tags": ["x_refsource_MISC"], "url": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e"}, {"name": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37", "tags": ["x_refsource_MISC"], "url": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37"}, {"name": "https://openwrt.org/advisory/2025-10-22-2", "tags": ["x_refsource_MISC"], "url": "https://openwrt.org/advisory/2025-10-22-2"}], "affected": [{"vendor": "openwrt", "product": "openwrt", "versions": [{"version": "< 24.10.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-22T14:59:15.265Z"}, "descriptions": [{"lang": "en", "value": "OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds."}], "source": {"advisory": "GHSA-h427-frpr-7cqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-22T17:24:08.319059Z", "id": "CVE-2025-62525", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T17:24:17.273Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-62525", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-22T17:24:08.319059Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-22T17:24:12.619Z"}}], "cna": {"title": "OpenWrt vulnerable to local privilage escalation", "source": {"advisory": "GHSA-h427-frpr-7cqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.9, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "openwrt", "product": "openwrt", "versions": [{"status": "affected", "version": "< 24.10.4"}]}], "references": [{"url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr", "name": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e", "name": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37", "name": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37", "tags": ["x_refsource_MISC"]}, {"url": "https://openwrt.org/advisory/2025-10-22-2", "name": "https://openwrt.org/advisory/2025-10-22-2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20: Improper Input Validation"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787: Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-10-22T14:59:15.265Z"}}}, "cveMetadata": {"cveId": "CVE-2025-62525", "state": "PUBLISHED", "dateUpdated": "2025-10-22T17:24:17.273Z", "dateReserved": "2025-10-15T15:03:28.135Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-10-22T14:59:15.265Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "openwrt", "vendor": "openwrt", "versions": [{"status": "affected", "version": "< 24.10.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*", "matchCriteriaId": "664FA3AA-8D48-43DD-9C7C-9A0D13EB63EE", "versionEndExcluding": "24.10.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds."}, {"lang": "es", "value": "El Proyecto OpenWrt es un sistema operativo Linux dirigido a dispositivos embebidos. Antes de la versi\u00f3n 24.10.4, los usuarios locales pod\u00edan leer y escribir memoria arbitraria del kernel usando los ioctls del controlador ltq-ptm, que se utiliza para controlar la ruta de datos de la l\u00ednea DSL. Esto solo afecta al objetivo lantiq que soporta SoCs xrx200, danube y amazon de Lantiq/Intel/MaxLinear con el DSL en modo PTM. El controlador DSL para el VRX518 no est\u00e1 afectado. El modo ATM tampoco est\u00e1 afectado. La mayor\u00eda de las l\u00edneas VDSL usan el modo PTM y la mayor\u00eda de las l\u00edneas ADSL usan el modo ATM. OpenWrt normalmente se ejecuta como un sistema de un solo usuario, pero algunos servicios est\u00e1n en un sandbox. Esta vulnerabilidad podr\u00eda permitir a los atacantes escapar de un sandbox ujail o de otros contenedores. Esto est\u00e1 corregido en OpenWrt 24.10.4. No hay soluciones alternativas."}], "id": "CVE-2025-62525", "lastModified": "2026-10-19T16:10:00.260", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.9, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 5.3, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62525", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-22T17:24:08.319059Z", "version": "2.0.3"}}]}, "published": "2025-10-22T15:16:07.017", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://openwrt.org/advisory/2025-10-22-2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-125"}, {"lang": "en", "value": "CWE-787"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-10-23T09:59:06.526506+00:00", "updated": "2025-10-23T09:59:06.526533+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "openwrt", "openwrt$PRODUCT$openwrt"]}