PT-2025-27948 · Mtr+2 · Mtr+2

Published 2025-06-29 · Updated 2025-08-06 · CVE-2025-49809

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: mtr versions 0.95 and earlier

Description: The issue concerns the mishandling of execution of a program specified by the MTR PACKET environment variable in certain privileged contexts. It is noted that mtr on macOS may often have Sudo rules due to Homebrew not installing setuid binaries.

Recommendations: For mtr versions 0.95 and earlier, consider restricting the use of the MTR PACKET environment variable in privileged contexts to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Weakness Enumeration

CWE-829

Related Identifiers

AZL-65136

AZL-65232

BDU:2025-11072

CVE-2025-49809

Affected Products

Debian

Red Os

Mtr

References · 21

• 🔥 https://github.com/traviscross/mtr/blob/master/SECURITY · Exploit
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-49809 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-49809 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-65136 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-49809 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-49809 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-49809 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-65232 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-49809 · Security Note
• https://bdu.fstec.ru/vul/2025-11072 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-49809 · Security Note