PT-2025-23106 · Isc+2 · Kea+2

Published 2025-05-28 · Updated 2026-03-26 · CVE-2025-32803

Positive Technologies (AI Summary)

CVSS v3.1

4.0

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Kea versions 2.4.0 through 2.4.1 Kea versions 2.6.0 through 2.6.2 Kea versions 2.7.0 through 2.7.8

Description In some cases, Kea log files or lease files may be world-readable.

Recommendations For Kea versions 2.4.0 through 2.4.1, update to a version outside of this range to mitigate the risk. For Kea versions 2.6.0 through 2.6.2, update to a version outside of this range to mitigate the risk. For Kea versions 2.7.0 through 2.7.8, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting access to the log files and lease files to minimize the risk of exploitation.

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

ALSA-2025:9178

BDU:2025-11745

CVE-2025-32803

OPENSUSE-SU-2025:15181-1

RHSA-2025:9178

SUSE-SU-2026:0907-1

SUSE-SU-2026:1091-1

Affected Products

Debian

Kea

Red Os

References · 42

• https://osv.dev/vulnerability/DEBIAN-CVE-2025-32803 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1091-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15181-1 · Vendor Advisory
• https://kb.isc.org/docs/cve-2025-32803 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-32803 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32803 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-32803 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0907-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2025:9178 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-32803 · Security Note
• https://errata.almalinux.org/10/ALSA-2025-9178.html · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32803 · Security Note
• https://bdu.fstec.ru/vul/2025-11745 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-32803 · Vendor Advisory