CVE-2025-32801 — Loading a malicious hook library can lead to local privilege escalation
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, …
Published: 2025-05-28 · CVSS: 7.8 · CVSS 3.1
Kea configuration and API directives can be used to load a malicious hook library. Many common configurations run Kea as root, leave the API entry points unsecured by default, and/or place the control sockets in insecure paths. This issue affects Kea versions 2.4.0 through 2.4.1, 2.6.0 through 2.6.2, and 2.7.0 through 2.7.8.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7