CVE-2025-62525

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-62525
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62525.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-62525
Aliases
  • GHSA-h427-frpr-7cqr
Downstream
Published
2025-10-22T14:59:15Z
Modified
2026-10-24T07:22:32Z
Severity
  • 7.9 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H CVSS Calculator
Summary
OpenWrt vulnerable to local privilage escalation
Details

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-125",
        "CWE-20",
        "CWE-787"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/62xxx/CVE-2025-62525.json"
}
References

Affected packages

Git / github.com/openwrt/openwrt

Affected ranges

Type
GIT
Repo
https://github.com/openwrt/openwrt
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
78b23a26c4c98938d549e7ff5876508544e33d4d
Fixed
2a76abc5442e3f74d95b4caa9bb57e5488fc132e
Fixed
e001b31163a77683ee741d169f794cfa50926f37
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "24.10.4"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "2a76abc5442e3f74d95b4caa9bb57e5488fc132e"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "range":  [
                {
                    "fixed":  "e001b31163a77683ee741d169f794cfa50926f37"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

Other
reboot
v24.*
v24.10.0
v24.10.0-rc1
v24.10.0-rc2
v24.10.0-rc3
v24.10.0-rc4
v24.10.0-rc5
v24.10.0-rc6
v24.10.0-rc7
v24.10.1
v24.10.2
v24.10.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-62525.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5652957480554944249673054794021110294",
            "length":  3195
        },
        "id":  "CVE-2025-62525-08b66acc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c",
            "function":  "ptm_ioctl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "16732168585285445911964945869872080108",
            "length":  2719
        },
        "id":  "CVE-2025-62525-32e9c9a4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c",
            "function":  "ptm_ioctl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "13000961464368767159405477951542802391",
                "24636532359120849727549057826412952030",
                "186287727785868107961995912551848832205",
                "339662186328617781753409479591660810140",
                "116047329217844097554038622178357827349",
                "4885259794698715904833262187050129388",
                "266655406931677767844793478101206931730",
                "338005291507051718422622747136299711357",
                "183213395634769543213949296519019568806",
                "9148544533476238680331645985256400414",
                "193306755934810735379397198164772326468",
                "262215994591282146658875193869353451563",
                "331413658583871244901818822246426744450",
                "336482974786542153806279800928569209415",
                "8421471585208229663113630217124019324",
                "219310055004083225074062604258583761519",
                "276154825791182346728209305151786709070",
                "196223809469316368677468375261728409430",
                "253980950209223291575532944310170579704",
                "71070885632021970861528510408726737141",
                "290817719340313563085544760409529922778",
                "315320438294331417798055838463325096663",
                "201645354521173341134469620544295796687",
                "17991029440650319734841788160406557956",
                "226979690318569961592569764778556121188",
                "338422158334418777110869566256897215058",
                "136006178959373892788760718964513550804",
                "22716202297272630825984511860937158022",
                "274141422400818132114870652147900091101",
                "232719850509891394601511029519984955336",
                "241101552150014071392573691567101200677",
                "256779172557459258357761035943933880657",
                "14224455484968816764944659819556676268",
                "188493466989793822086897151928095824250",
                "331249373351805800442402050950417564034",
                "26490829785717750625320773505013498661",
                "101622443987409617116064243448002435015",
                "10256740355632026953345747664548108785",
                "324294775533267758419888953701256555701",
                "132402528737845758058681477002723984329",
                "5548904738147957147818726470247908711",
                "261390860265609028803408449675364383321",
                "245003747102242296035147604689462988755",
                "53551119990386173450005501171693271084",
                "110218138785058812215103920862486368628",
                "218148693074149189627068133007441065786",
                "136630255472296279829714875684654292245",
                "50802418182001362965364363617837396713",
                "82955005554191202057869354712476300513",
                "186561307309092950499344088485201687205",
                "153884113293129964735909812815372314069",
                "76908408830770334767343067942102746902",
                "21964019357841516924246880359389909449",
                "314695787002869555798240549579320266351",
                "202765939697051463302648448206479237810",
                "102686667601183223968351014724450066558"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-62525-3bd58c23",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "16732168585285445911964945869872080108",
            "length":  2719
        },
        "id":  "CVE-2025-62525-3d5f619f",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c",
            "function":  "ptm_ioctl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "251336106655121729409533735234559230177",
                "20743239978271032913397484371034042886",
                "281268547347690024199096179760161605079",
                "248057538204558972448699398001363720346",
                "116047329217844097554038622178357827349",
                "4885259794698715904833262187050129388",
                "266655406931677767844793478101206931730",
                "338005291507051718422622747136299711357",
                "183213395634769543213949296519019568806",
                "9148544533476238680331645985256400414",
                "193306755934810735379397198164772326468",
                "262215994591282146658875193869353451563",
                "331413658583871244901818822246426744450",
                "336482974786542153806279800928569209415",
                "8421471585208229663113630217124019324",
                "219310055004083225074062604258583761519",
                "276154825791182346728209305151786709070",
                "196223809469316368677468375261728409430",
                "253980950209223291575532944310170579704",
                "71070885632021970861528510408726737141",
                "290817719340313563085544760409529922778",
                "315320438294331417798055838463325096663",
                "201645354521173341134469620544295796687",
                "17991029440650319734841788160406557956",
                "226979690318569961592569764778556121188",
                "338422158334418777110869566256897215058",
                "136006178959373892788760718964513550804",
                "22716202297272630825984511860937158022",
                "274141422400818132114870652147900091101",
                "232719850509891394601511029519984955336",
                "241101552150014071392573691567101200677",
                "256779172557459258357761035943933880657",
                "14224455484968816764944659819556676268",
                "188493466989793822086897151928095824250",
                "331249373351805800442402050950417564034",
                "26490829785717750625320773505013498661",
                "101622443987409617116064243448002435015",
                "10256740355632026953345747664548108785",
                "324294775533267758419888953701256555701",
                "132402528737845758058681477002723984329",
                "5548904738147957147818726470247908711",
                "261390860265609028803408449675364383321",
                "245003747102242296035147604689462988755",
                "53551119990386173450005501171693271084",
                "110218138785058812215103920862486368628",
                "218148693074149189627068133007441065786",
                "136630255472296279829714875684654292245",
                "50802418182001362965364363617837396713",
                "82955005554191202057869354712476300513",
                "186561307309092950499344088485201687205",
                "153884113293129964735909812815372314069",
                "76908408830770334767343067942102746902",
                "21964019357841516924246880359389909449",
                "314695787002869555798240549579320266351",
                "202765939697051463302648448206479237810",
                "102686667601183223968351014724450066558"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-62525-4757fd6a",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_adsl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "269099280629038017373818212876495082217",
                "231647443047741203256826403270298910470",
                "275776503217610166116397224209743998971",
                "231519924506517871268519840123881908683",
                "100758477023972733846166585549931327357",
                "290179461491750879026109722532735169263",
                "134012320129267501481082230165818999980",
                "235459807960918799870638261828916902127",
                "105079575347294850822380219459921423327",
                "177049099170526942389402377644294644406",
                "296307124044171215514006170696754256739",
                "212744253588038788693501281715522522013",
                "170364048413447730593387905558597147768",
                "31326121829804760979599013001718898572",
                "131007456472507381015236216496180820584",
                "252116590458710603485404873317177744983",
                "233134239235393799207405818458482554552",
                "214651004029359940009409614132182251260",
                "43756214894367793593256163233382275513",
                "315865812554225191022153426109999950062",
                "338403580699465913865812520969368217773",
                "147805860675382573557097173561944749075",
                "124074668514173096944320621398024217653",
                "43422972222477210643871037864757769065",
                "160244293526474247183706050006890822522",
                "179243508369873525669609591107045543674",
                "190379842530960405404226121075625996170",
                "275731943999759342450389311775295090583",
                "179653568196506247255561670905498405692",
                "97175373802678062956220754703558079582",
                "80907478821114657520852386690660641524",
                "172889969190326531094786405806125687316",
                "309107109032244887421159813901002673936",
                "127357672693915055346027442120292476351",
                "167620727942630348775172378762232879594",
                "203258535082547879453329924606676377095",
                "138453496027381049899300869983012973356",
                "42514654193832998607578283075816296423",
                "301908139514181298835969322788581015060",
                "195783720093936730283631566946953118285"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-62525-7315cb49",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "5652957480554944249673054794021110294",
            "length":  3195
        },
        "id":  "CVE-2025-62525-a6439d16",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/e001b31163a77683ee741d169f794cfa50926f37",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c",
            "function":  "ptm_ioctl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "269099280629038017373818212876495082217",
                "231647443047741203256826403270298910470",
                "275776503217610166116397224209743998971",
                "231519924506517871268519840123881908683",
                "100758477023972733846166585549931327357",
                "290179461491750879026109722532735169263",
                "134012320129267501481082230165818999980",
                "235459807960918799870638261828916902127",
                "105079575347294850822380219459921423327",
                "177049099170526942389402377644294644406",
                "296307124044171215514006170696754256739",
                "212744253588038788693501281715522522013",
                "170364048413447730593387905558597147768",
                "31326121829804760979599013001718898572",
                "131007456472507381015236216496180820584",
                "252116590458710603485404873317177744983",
                "233134239235393799207405818458482554552",
                "214651004029359940009409614132182251260",
                "43756214894367793593256163233382275513",
                "315865812554225191022153426109999950062",
                "338403580699465913865812520969368217773",
                "147805860675382573557097173561944749075",
                "124074668514173096944320621398024217653",
                "43422972222477210643871037864757769065",
                "160244293526474247183706050006890822522",
                "179243508369873525669609591107045543674",
                "190379842530960405404226121075625996170",
                "275731943999759342450389311775295090583",
                "179653568196506247255561670905498405692",
                "97175373802678062956220754703558079582",
                "80907478821114657520852386690660641524",
                "172889969190326531094786405806125687316",
                "309107109032244887421159813901002673936",
                "127357672693915055346027442120292476351",
                "167620727942630348775172378762232879594",
                "203258535082547879453329924606676377095",
                "138453496027381049899300869983012973356",
                "42514654193832998607578283075816296423",
                "301908139514181298835969322788581015060",
                "195783720093936730283631566946953118285"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2025-62525-d6e65af6",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/openwrt/openwrt/commit/2a76abc5442e3f74d95b4caa9bb57e5488fc132e",
        "target":  {
            "file":  "package/kernel/lantiq/ltq-ptm/src/ifxmips_ptm_vdsl.c"
        }
    }
]
vanir_signatures_modified 
"2026-10-24T07:22:32Z"