CVE-2025-25066
Published: 03 February 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-25066, published on 2025-02-03, is a potential stack-based buffer overflow vulnerability (CWE-121) in the ndpi_address_cache_restore function located in lib/ndpi_cache.c of nDPI through version 4.12. This flaw carries a CVSS v3.1 base score of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating high severity due to its potential for significant impact across confidentiality, integrity, and availability with a changed scope.
The vulnerability can be exploited by a local attacker requiring no privileges (PR:N), though it demands high attack complexity (AC:H) and no user interaction (UI:N). With local access vector (AV:L), a successful exploit could grant the attacker high-level control, potentially enabling arbitrary code execution, data corruption, or system crashes, while the changed scope (S:C) allows impacts beyond the vulnerable component.
Mitigation is addressed in a patch via the GitHub commit at https://github.com/ntop/nDPI/commit/678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb. Security practitioners should apply this fix by updating nDPI to a patched version to prevent exploitation.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Local stack-based buffer overflow enabling arbitrary code execution with no privileges required directly maps to exploitation for privilege escalation.