Medium severity · published May 5, 2025
CVE-2025-47268
ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit…
6.5
CVSS
1.7%
EPSS
No
On KEV
Description
ping in iputils before 20250602 allows a denial of service (application error or incorrect data collection) via a crafted ICMP Echo Reply packet, because of a signed 64-bit integer overflow in timestamp multiplication.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.7% · higher than 78% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IP
Iputils · Iputils
before 20250602 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-47268
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-47268
Issue Tracking
https://bugzilla.suse.com/show_bug.cgi?id=1242300
Exploit
https://github.com/Zephkek/ping-rtt-overflow/
Patch
https://github.com/iputils/iputils/commit/070cfacd7348386173231fb16fad4983d4e6ae40
Exploit
https://github.com/iputils/iputils/issues/584
Exploit
https://github.com/iputils/iputils/pull/585
Release Notes
https://github.com/iputils/iputils/releases/tag/20250602
More from Iputils
–
CVE-2000-1213
ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J and other operating systems, does not drop privileges after acquiring a raw socket, which increases…
–
CVE-2000-1214
Buffer overflows in the (1) outpack or (2) buf variables of ping in iputils before 20001010, as distributed on Red Hat Linux 6.2 through 7J and other operating systems, may allow…