File Overwrite Vulnerability in ISC Kea: CVE-2025-32802
Summary
CVE-2025-32802: Kea configuration and API directives can be used to overwrite arbitrary files, subject to permissions granted to Kea. Affects kea versions < 2.6.3-r0. Fixed in 2.6.3-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ISC Kea is a widely used open-source DHCP server that provides dynamic IP address allocation and management for networks. It is known for its flexibility, scalability, and robust API that allows for extensive configuration and integration. However, certain configurations can expose the server to security risks, particularly when run with elevated privileges or with unsecured API endpoints.
Vulnerability Detail
The vulnerability identified as CVE-2025-32802 allows for arbitrary file overwriting due to insecure configurations in ISC Kea. This issue arises when Kea is run with root privileges, and the API entry points are left unsecured. Additionally, control sockets may be placed in insecure paths, enabling unauthorized users to exploit these weaknesses. The potential ramifications include unauthorized access to sensitive files, system compromise, and disruption of service, making it critical for users to address this vulnerability promptly.
How To Fix
Minimum fixed version
2.6.3-r0
This is the first release that contains the fix.
sudo apk add --upgrade keaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the API by implementing proper authentication mechanisms and ensuring that control sockets are placed in secure directories. Additionally, running Kea with non-root privileges can mitigate the risk of file overwriting.
Conclusion
CVE-2025-32802 represents a significant security risk for users of ISC Kea due to its potential for arbitrary file overwriting. It is crucial for users to update their installations to the latest versions and implement security best practices to mitigate this vulnerability.
See every vulnerability recorded for kea →
FAQ
CVE-2025-32802 is a vulnerability in ISC Kea that allows for arbitrary file overwriting due to insecure configurations.
The affected versions are 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of this vulnerability is 6.1, indicating a moderate level of severity.
Ensure that you update to the latest patched version of ISC Kea, secure API endpoints, and restrict access to control sockets.
Related vulnerabilities
Recent vulnerabilities recorded for kea.
