CVE-2025-62525

{
  "id": "CVE-2025-62525",
  "sourceIdentifier": "[email protected]",
  "published": "2025-10-22T15:16:07.017",
  "lastModified": "2026-10-19T16:10:00.260",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds."
    },
    {
      "lang": "es",
      "value": "El Proyecto OpenWrt es un sistema operativo Linux dirigido a dispositivos embebidos. Antes de la versión 24.10.4, los usuarios locales podían leer y escribir memoria arbitraria del kernel usando los ioctls del controlador ltq-ptm, que se utiliza para controlar la ruta de datos de la línea DSL. Esto solo afecta al objetivo lantiq que soporta SoCs xrx200, danube y amazon de Lantiq/Intel/MaxLinear con el DSL en modo PTM. El controlador DSL para el VRX518 no está afectado. El modo ATM tampoco está afectado. La mayoría de las líneas VDSL usan el modo PTM y la mayoría de las líneas ADSL usan el modo ATM. OpenWrt normalmente se ejecuta como un sistema de un solo usuario, pero algunos servicios están en un sandbox. Esta vulnerabilidad podría permitir a los atacantes escapar de un sandbox ujail o de otros contenedores. Esto está corregido en OpenWrt 24.10.4. No hay soluciones alternativas."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "openwrt",
          "product": "openwrt",
          "versions": [
            {
              "version": "< 24.10.4",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H",
          "baseScore": 7.9,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 5.3
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-10-22T17:24:08.319059Z",
          "id": "CVE-2025-62525",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-125"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "24.10.4",
              "matchCriteriaId": "664FA3AA-8D48-43DD-9C7C-9A0D13EB63EE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/openwrt/openwrt/security/advisories/GHSA-h427-frpr-7cqr",
      "source": "[email protected]",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://openwrt.org/advisory/2025-10-22-2",
      "source": "[email protected]",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}