PT-2025-23035 · Unknown+1 · Net::Cidr::Set+2

Robert Rothenberg · Published 2025-05-27 · Updated 2025-05-28 · CVE-2025-40911

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Net::CIDR::Set versions 0.10 through 0.13

Description The issue arises from the improper handling of leading zero characters in IP CIDR address strings, potentially allowing attackers to bypass access control based on IP addresses. This is due to the interpretation of leading zeros as indicating octal numbers, which can cause confusion among users, whether they intend to use octal or decimal notation. The vulnerable code originates from Net::CIDR::Lite, which had a similar issue.

Recommendations For Net::CIDR::Set versions 0.10 through 0.13, consider updating to a version that properly handles leading zero characters in IP CIDR address strings to prevent potential access control bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-40911

Affected Products

Debian

Net-Cidr-Lite

Net::Cidr::Set

References · 14

• https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-40911 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-40911 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-40911 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-40911 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-40911 · Security Note
• https://osv.dev/vulnerability/CVE-2025-40911 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-40911 · Vendor Advisory
• https://metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes · Note
• https://t.me/cvenotify/123766 · Telegram Post
• https://twitter.com/CVEnew/status/1927478202181583019 · Twitter Post
• https://lists.security.metacpan.org/cve-announce/msg/29942240 · Note
• https://t.me/cvetracker/24775 · Telegram Post
• https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros · Note