PT-2025-27144 · Unknown · Net::Ip::Lpm

Published 2025-06-27 · Updated 2025-06-27 · CVE-2025-40910

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Net::IP::LPM version 1.10

Description: The issue arises from the improper consideration of leading zero characters in IP CIDR address strings, potentially allowing attackers to bypass access control based on IP addresses. This confusion can affect users who intentionally use octal notation, as well as those who believe they are using decimal notation, due to the use of leading zeros to indicate octal numbers.

Recommendations: For Net::IP::LPM version 1.10, consider updating to a version that properly handles leading zero characters in IP CIDR address strings to prevent potential access control bypass. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-1287

Related Identifiers

CVE-2025-40910

Affected Products

Net::Ip::Lpm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-40910 · Security Note
• https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patch · Patch
• https://t.me/cvenotify/126876 · Telegram Post
• https://t.me/cvenotify/126955 · Telegram Post
• https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pm · Note
• https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros · Note
• https://twitter.com/CVEnew/status/1938585377226551471 · Twitter Post