TI-2025-31527 Aliases CVE-2025-49491 GHSA-f65m-4w8w-h76q

Resource leaks in traffic_stat

LOW 24CWE-404Published 2025-07-01 · Updated 2025-07-01

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-404.

Summary

Improper Resource Shutdown or Release vulnerability in ASR Falcon_Linux、Kestrel、Lapwing_Linux on Linux (traffic_stat modules) allows Resource Leak Exposure. This vulnerability is associated with program files traffic_stat/traffic_service/traffic_service.C. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00288 21st percentileScored 2026-11-07

Fix Fixed Falcon_Linux、Kestrel、Lapwing_Linux (ASR): v1536

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
ASR	Falcon_Linux、Kestrel、Lapwing_Linux	before v1536	v1536	Patch available	CNA

Falcon_Linux、Kestrel、Lapwing_Linux VendorASR Affected before v1536 Fixed in v1536 Patch available CNA

CPE configurations NVD · 7

CPE	Versions	Role	Vendor
cpe:2.3:o:asrmicro:falcon_linux::::::::	before 1536	Vulnerable	ASR
cpe:2.3:o:asrmicro:kestrel::::::::	before 1536	Vulnerable	ASR
cpe:2.3:o:asrmicro:lapwing_linux::::::::	before 1536	Vulnerable	ASR
cpe:2.3:h:asrmicro:asr1803:-:::::::*	not specified by NVD	Running on	ASR
cpe:2.3:h:asrmicro:asr1806:-:::::::*	not specified by NVD	Running on	ASR
cpe:2.3:h:asrmicro:asr1901:-:::::::*	not specified by NVD	Running on	ASR
cpe:2.3:h:asrmicro:asr1903:-:::::::*	not specified by NVD	Running on	ASR

cpe:2.3:o:asrmicro:falcon_linux:*:*:*:*:*:*:*:* Versions before 1536 Vulnerable ·ASR
cpe:2.3:o:asrmicro:kestrel:*:*:*:*:*:*:*:* Versions before 1536 Vulnerable ·ASR
cpe:2.3:o:asrmicro:lapwing_linux:*:*:*:*:*:*:*:* Versions before 1536 Vulnerable ·ASR
cpe:2.3:h:asrmicro:asr1803:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASR
cpe:2.3:h:asrmicro:asr1806:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASR
cpe:2.3:h:asrmicro:asr1901:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASR
cpe:2.3:h:asrmicro:asr1903:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·ASR

Remediation

Fix · CNA Falcon_Linux、Kestrel、Lapwing_Linux (ASR) Fixed in v1536

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2025-07-01
ASR Falcon_Linux、Kestrel、Lapwing_Linux v1536
10 records Highest priority Priority MEDIUM 1 MEDIUM, 9 LOW
Other records, highest priority first
- TI-2025-31528 Out-of-bounds write in lte-telephonyPriority MEDIUM 42
- TI-2025-31516 Out-of-bounds access in lte-telephonyPriority LOW 39
- TI-2025-31526 Resource leaks in routerPriority LOW 24
Show all 10 records →

Timeline

2026-10-02 Threatist record created from CVE-2025-49491
2026-10-03 Alias added: GHSA-f65m-4w8w-h76q

References

Advisory 1

https://www.asrmicro.com/en/goods/psirt?cid=40

TI-2025-31528 Out-of-bounds write in lte-telephony CVSS 3.1CRITICAL 9.8
TI-2025-31516 Out-of-bounds access in lte-telephony CVSS 3.1CRITICAL 9.1
TI-2025-31526 Resource leaks in router CVSS 3.1MEDIUM 5.4
TI-2025-31525 Resource leaks in cm CVSS 3.1MEDIUM 5.4
TI-2025-31524 Resource leaks in router CVSS 3.1MEDIUM 5.4
TI-2025-31519 Resource leaks in tr069 CVSS 3.1MEDIUM 5.4

See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences