CVE-2025-32801: Privilege Escalation in Kea DHCP Server

The primary impact of CVE-2025-32801 is the potential for an attacker to gain root privileges on the system hosting the Kea DHCP server. This is particularly concerning because many Kea deployments run as root and expose API entry points without proper security controls. Successful exploitation could allow an attacker to modify DHCP configurations, redirect network traffic, compromise other systems on the network, and potentially achieve complete control over the affected server. The ease of exploitation is amplified by the default insecure configurations often found in Kea installations, such as placing control sockets in accessible locations.

1. Reserved2025-04-10
2. Published2025-05-28
3. EPSS updated2026-03-23

The primary mitigation for CVE-2025-32801 is to upgrade to Kea version 2.7.9 or later. Prior to upgrading, assess the impact on dependent systems and plan a rollback strategy if necessary. Review Kea's API configuration and restrict access to authorized clients only. Ensure control sockets are not accessible from untrusted networks. Implement network segmentation to limit the blast radius of a potential compromise. Consider using a Web Application Firewall (WAF) to filter malicious requests targeting the Kea API. After upgrading, verify the fix by attempting to load a malicious hook library via the API and confirming that the attempt is denied.