Medium severity · published May 28, 2025
CVE-2025-32802
Insecure handling of file paths allows multiple local attacks
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths.
This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 13% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KE
Kea · ISC
2.4.0 through 2.4.1; 2.6.0 through 2.6.2; 2.7.0 through 2.7.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-32802
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-32802
kb.isc.org
https://kb.isc.org/docs/cve-2025-32802
More from Kea
7.8
CVE-2025-32801
Loading a malicious hook library can lead to local privilege escalation
7.5
CVE-2026-3608
Stack overflow in Kea daemons
7.5
CVE-2025-11232
Invalid characters cause assert
7.5
CVE-2025-40779
Kea crash upon interaction between specific client options and subnet selection
7.5
CVE-2018-5739
Failure to release memory may exhaust system resources