CVE-2025-62525
HighCVSS 7.9Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
In OpenWrt prior to 24.10.4, local users could read and write arbitrary kernel memory using ioctls of the ltq-ptm driver (affects lantiq target with xrx200, danube, and amazon SoCs in PTM mode). This could allow escaping a ujail sandbox or other containers; no workarounds exist.
Risk Assessment
A local attacker could access kernel memory and escape sandboxes, potentially leading to full device compromise.
Recommendation
Update OpenWrt to version 24.10.4 or later, which contains the fix.
Other vulnerabilities in OpenWrt
See all- CVE-2026-62947Medium
OpenWrt prior to version 25.12.5 has a vulnerability in the cgi-download handler in cgi-io that allows reading root-readable files including /etc/shadow via path traversal using an allowed wildcard prefix followed by ../.
- CVE-2026-55490Medium
In OpenWrt before v25.12.5, an integer underflow in the handle_send_a() function of the Emergency Access Daemon allows any unauthenticated attacker on the local network to crash the daemon by sending a single crafted UDP packet. The issue is fixed in v25.12.5.
- CVE-2025-62526High
Prior to version 24.10.4, ubusd in OpenWrt contains a heap buffer overflow in the event registration parsing code. This allows an attacker to modify the head and potentially execute arbitrary code in the context of the ubus daemon; the affected code runs before ACL checks, so all ubus clients can send such messages. The crafted subscription also bypasses the listen ACL. This is fixed in OpenWrt 24.10.4.
Original NVD description (English source)
OpenWrt Project is a Linux operating system targeting embedded devices. Prior to version 24.10.4, local users could read and write arbitrary kernel memory using the ioctls of the ltq-ptm driver which is used to drive the datapath of the DSL line. This only effects the lantiq target supporting xrx200, danube and amazon SoCs from Lantiq/Intel/MaxLinear with the DSL in PTM mode. The DSL driver for the VRX518 is not affected. ATM mode is also not affected. Most VDSL lines use PTM mode and most ADSL lines use ATM mode. OpenWrt is normally running as a single user system, but some services are sandboxed. This vulnerability could allow attackers to escape a ujail sandbox or other contains. This is fixed in OpenWrt 24.10.4. There are no workarounds.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS