The library fails to properly validate IP addresses and CIDR masks, permitting input strings such as a trailing newline or non‑ASCII characters to be accepted and then re‑encoded by the parser to a misleading network address. When the library’s find() or bin_find() functions are invoked, they may incorrectly report a match, allowing an attacker to bypass IP‑based access control lists. This flaw is an input‑validation weakness, identified as CWE‑1289.

The flaw affects the Net::CIDR::Lite Perl module provided by STIGTSP, specifically all versions prior to 0.24.

Because the vulnerability permits control over the network address used in ACL checks, an attacker with the ability to supply arbitrary strings to the module could gain unauthorized access to protected resources. The precise exploitability depends on how the library is integrated into an application; if user input flows directly into the module, remote exploitation is possible, based on an inferred attack scenario. The CVSS score is 6.5, the EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog.