CVE-2025-32801

Vulnerability

Description

The Kea DHCP server allows loading hook libraries through configuration directives and API commands. In many common deployments, Kea runs as root, leaves API entry points unsecured by default, or places control sockets in insecure paths. This design flaw enables an attacker with local unprivileged access to instruct Kea to load a malicious hook library from an arbitrary file [1].

Exploitation

Prerequisites

An attacker must have access to a local unprivileged user account on the system. Additionally, the Kea API entry points must not be secured—either because authentication is disabled or control sockets are placed in world-writable directories. Under these conditions, the attacker can send API commands to load a hook library they control [1].

Impact

The malicious hook library executes with the privileges of the Kea process, which is often root. This results in full compromise of the system's confidentiality, integrity, and availability. The vulnerability has a CVSS v3 score of 7.8 (High) [1].

Mitigation

ISC has released patched versions: 2.4.2, 2.6.3, and 2.7.9. As a workaround, administrators can disable the Kea API entirely or secure it by requiring authentication and restricting control socket directories to trusted users. No active exploits have been reported [1].