PT-2025-31268 · Unknown+1 · Webassembly Micro Runtime+1

Linear0211 · Published 2025-07-29 · Updated 2025-07-29 · CVE-2025-54126

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions WebAssembly Micro Runtime (WAMR) iwasm versions 2.4.0 and below

Description The iwasm package uses the --addr-pool option with an IPv4 address lacking a subnet mask. This configuration allows the system to accept all IP addresses, potentially exposing the service to unintended external connections and bypassing intended access restrictions. This may lead to unauthorized access, particularly in production deployments where users expect a secure configuration when specifying an IP address without a subnet mask.

Recommendations Update to version 2.4.1 or later.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

AZL-66045

AZL-66048

CVE-2025-54126

GHSA-VH64-MFVW-PXQP

Affected Products

Webassembly Micro Runtime

Iwasm

References · 10

• 🔥 https://github.com/bytecodealliance/wasm-micro-runtime/security/advisories/GHSA-vh64-mfvw-pxqp · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54126.json · Exploit
• https://github.com/bytecodealliance/wasm-micro-runtime/commit/121232a9957a069bbb04ebda053bdc72ab409e7a · Patch
• https://osv.dev/vulnerability/AZL-66048 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-66045 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54126 · Security Note
• https://github.com/bytecodealliance/wasm-micro-runtime/releases/tag/WAMR-2.4.1 · Note
• https://twitter.com/CVEnew/status/1950319611821641982 · Twitter Post
• https://t.me/cveNotify/130192 · Telegram Post