The vulnerability arises from incorrect validation of network mask values in Net::CIDR::Set versions up to 0.20. Unicode digits such as Arabic‑Indic numerals and other non‑digit characters are ignored, enabling the module to accept mask values that represent larger networks than intended. Leading zeros are also treated as decimal rather than octal, causing further misinterpretation of permitted address ranges. The weakness is an instance of input validation failure (CWE‑1289) that can lead to broader than expected network scopes, potentially allowing an attacker to gain unauthorized access or influence traffic classification.

The issue affects the Perl module Net::CIDR::Set provided by RRWO. Versions up to and including 0.20 are vulnerable. An upgrade to version 0.21 or later resolves the validation logic problems.

Because the vulnerability is limited to the interpretation of network mask values, it is mainly exploitable in contexts where an attacker can supply or influence that data, such as configuration files, scripts, or network‑related services that consume this Perl module. Although there is no EPSS score and the vulnerability is not listed in the KEV catalog, the lack of proper validation could lead to disproportionate network access if the module is used in security‑critical code. The CVSS score of 7.3 indicates a high severity. Consequently, the risk is moderate to high, and mitigations should be applied promptly.