Vulnerability in Kea DHCP Server Leads to Potential Malicious Hook Library Execution
CVE-2025-32801

7.8HIGH

Key Information:

Vendor

Isc
Status
Kea
Vendor
CVE Published:
28 May 2025

Badges

👾 Exploit Exists

What is CVE-2025-32801?

The Kea DHCP Server has a vulnerability that allows configuration and API directives to load a malicious hook library. Many common configurations run Kea as the root user, leaving the API entry points unsecured by default and placing control sockets in insecure paths. This opens up potential for unauthorized access and exploitability, impacting systems running vulnerable versions of Kea DHCP Server.

Affected Version(s)

Kea 2.4.0 <= 2.4.1

Kea 2.6.0 <= 2.6.2

Kea 2.7.0 <= 2.7.8

References

https://kb.isc.org/docs/cve-2025-32801
vendor-advisory

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

ISC would like to thank Matthias Gerstner from the SUSE security team and Laura Pardo from Red Hat's Product Security Team for bringing this vulnerability to our attention.
.
CVE-2025-32801 : Vulnerability in Kea DHCP Server Leads to Potential Malicious Hook Library Execution