Read the docs
TI-2025-38765 Aliases CVE-2025-62525

OpenWrt vulnerable to local privilage escalation

Priority LOW 37CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed openwrt (openwrt): 24.10.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
openwrtopenwrtbefore 24.10.424.10.4Patch availableCNA
  • openwrt Vendoropenwrt Affected before 24.10.4 Fixed in 24.10.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:*before 24.10.4Vulnerableopenwrt
  • cpe:2.3:o:openwrt:openwrt:*:*:*:*:*:*:*:* Versions before 24.10.4 Vulnerable ·openwrt

Remediation

  • Fix · CNA openwrt (openwrt) Fixed in 24.10.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-62525

References

Patch 3

Advisory 1

  • TI-2024-13053 Improper input validation in MediaTek MT6890, MT7915, MT7916, MT7981, MT7986 CVSS 3.1CRITICAL 9.8
  • TI-2026-44983 Cross-site scripting in openwrt CVSS 3.1CRITICAL 9.6
  • TI-2026-40045 OpenWrt: EAD Integer Underflow → Pre-Auth Denial of Service CVSS 3.1MEDIUM 6.5
  • TI-2023-09914 LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored… CVSS 3.1MEDIUM 5.4
  • TI-2026-44982 OpenWrt: ACL bypass and arbitrary root file read via cgi-io cgi-download CVSS 3.1MEDIUM 4.9
  • TI-2026-23701 OpenWrt Project has a Stack-based Buffer Overflow vulnerability via IPv6 reverse DNS lookup CVSS 4.0CRITICAL 9.5
See all 136 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences