Vulnerability

CERT-In Vulnerability Note CIVN-2025-0105
Multiple Vulnerabilities in ISC Kea

Original Issue Date:June 02, 2025

Severity Rating: HIGH

Software Affected

ISC Kea versions 2.4.0 -> 2.4.1
ISC Kea versions 2.6.0 -> 2.6.2
ISC Kea versions 2.7.0 -> 2.7.8

Note: (Versions prior to 2.4.0 were not assessed)

Overview

Multiple vulnerabilities have been reported in ISC Kea which could allow an attacker to execute arbitrary code, modify or access sensitive files, escalate privileges and potentially cause denial of service on the targeted system.

Target Audience:
All end-user organizations and individuals using ISC Kea.

Risk Assessment:
Execute arbitrary code, modify or access sensitive files, escalate privileges and potentially cause denial of service.

Impact Assessment:
Authoritative servers and Resolvers are affected by these vulnerabilities.

Description

ISC Kea is an open-source, modern DHCP server, designed to replace the older ISC DHCP server. Kea supports both DHCPv4 and DHCPv6 and is built with a modular architecture to meet the needs of contemporary networks.

Multiple vulnerabilities exist in ISC Kea due to insufficient restrictions on configuration and API directives, inadequate validation of file paths in API operations, and overly permissive default file permissions. An attacker could exploit these vulnerabilities to load a malicious hook library from an arbitrary local file, modify sensitive files, or access Kea-generated logs and lease files, potentially exposing information about DHCP clients or the Kea service itself.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, modify or access sensitive files, escalate privileges and potentially cause denial of service on the targeted system. The impact depends on the Kea deployment, particularly if it runs with elevated privileges or exposes unsecured API endpoints.

Solution

Apply appropriate updates as mentioned by the vendor:
https://downloads.isc.org/isc/kea/2.4.2/Kea-2.4.2-ReleaseNotes.txt

https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt

https://downloads.isc.org/isc/kea/2.7.9/Kea-2.7.9-ReleaseNotes.txt

Vendor Information

ISC Kea
https://downloads.isc.org/isc/kea/2.4.2/Kea-2.4.2-ReleaseNotes.txt
https://downloads.isc.org/isc/kea/2.6.3/Kea-2.6.3-ReleaseNotes.txt
https://downloads.isc.org/isc/kea/2.7.9/Kea-2.7.9-ReleaseNotes.txt

References

CVE Name
CVE-2025-32801
CVE-2025-32802
CVE-2025-32803

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India