CVE-2025-32803

Description

A vulnerability was found in the Kea package, where an attacker with access to a local unprivileged user may be able to read the logs and DHCP lease information. This can be used to retrieve sensitive information about the DHCP clients and about the Kea process itself.

Statement

The Red Hat Product Security team has rated this vulnerability as with Moderate severity. An attacker needs to have a local account with read privileges to where the Kea's logs are being written to. Although information regarding DHCP clients and the Kea process can be retrieved, initially no sensitive information is leak through the logs leading to a low impact in the Confidentiality aspect.

Mitigation

This issue can be mitigated by ensuring the directories which contain the log files and lease information can be only accessed by trusted or privileged users.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score3.3N/A4
Attack VectorLocalN/ALocal
Attack ComplexityLowN/ALow
Privileges RequiredLowN/ANone
User InteractionNoneN/ANone
ScopeUnchangedN/AUnchanged
ConfidentialityLowN/ALow
Integrity ImpactNoneN/ANone
Availability ImpactNoneN/ANone

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

cve.org: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Understanding the Weakness (CWE)

CWE-538

Confidentiality

Technical Impact: Read Files or Directories

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.