Low severityOSV Advisory· Published Jun 24, 2025· Updated Apr 15, 2026

CVE-2025-52570

Description

Letmein is an authenticating port knocker. Prior to version 10.2.1, The connection limiter is implemented incorrectly. It allows an arbitrary amount of simultaneously incoming connections (TCP, UDP and Unix socket) for the services letmeind and letmeinfwd. Therefore, the command line option num-connections is not effective and does not limit the number of simultaneously incoming connections. This issue has been patched in version 10.2.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
letmeindcrates.io	< 10.2.1	10.2.1
letmeinfwdcrates.io	< 10.2.1	10.2.1

Affected products

Mbuesch/LetmeinOSV
Range: letmein-1.0.0, letmein-1.1.0, letmein-10.0.0, …
ghsa-coords2 versions
pkg:cargo/letmeind pkg:cargo/letmeinfwd
< 10.2.1+ 1 more
- (no CPE)range: < 10.2.1
- (no CPE)range: < 10.2.1

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-jpv7-p47h-f43jghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-52570ghsaADVISORY
github.com/mbuesch/letmein/commit/43207cd77580410d97165d1e3c07361ba6f3558cnvdWEB
github.com/mbuesch/letmein/security/advisories/GHSA-jpv7-p47h-f43jnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.065
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000