PT-2025-26665 · Letmein · Letmein

Mbuesch · Published 2025-06-23 · Updated 2025-06-24 · CVE-2025-52570

Positive Technologies (AI Summary)

CVSS v4.0

1.7

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions: Letmein versions prior to 10.2.1

Description: The connection limiter in Letmein is implemented incorrectly, allowing an arbitrary amount of simultaneously incoming connections for the services letmeind and letmeinfwd. This makes the command line option num-connections ineffective, and it does not limit the number of simultaneously incoming connections. The issue can lead to a Possible Denial Of Service by resource exhaustion.

Recommendations: For versions prior to 10.2.1, upgrade to version 10.2.1 to resolve the issue. As a temporary workaround, consider limiting the number of active connections to the letmeind port via firewall or restricting the resource consumption of the service with a service manager such as systemd.

Exploit

Fix

Allocation of Resources Without Limits

Weakness Enumeration

CWE-799

CWE-770

Related Identifiers

CVE-2025-52570

GHSA-JPV7-P47H-F43J

Affected Products

Letmein

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52570.json · Exploit
• https://osv.dev/vulnerability/GHSA-jpv7-p47h-f43j · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-52570 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-52570 · Security Note
• https://github.com/mbuesch/letmein · Note
• https://github.com/mbuesch/letmein/security/advisories/GHSA-jpv7-p47h-f43j · Note
• https://github.com/mbuesch/letmein/commit/43207cd77580410d97165d1e3c07361ba6f3558c · Note
• https://t.me/cvenotify/126457 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1937442541089046714 · Twitter Post
• https://t.me/cvetracker/26914 · Telegram Post
• https://twitter.com/CVEnew/status/1937366675919155399 · Twitter Post