CVE-2025-15638 identifies a vulnerability in ATRODO's Net::Dropbear Perl module versions prior to 0.14 due to the inclusion of outdated libtomcrypt versions (v1.18.1 or earlier). These libtomcrypt versions are known to be vulnerable to CVE-2016-6129 and CVE-2018-12437. Since Net::Dropbear bundles Dropbear 2019.78 or earlier, it inherits these vulnerable cryptographic components. The vulnerability is categorized under CWE-1395, indicating dependency on a vulnerable third-party component. No CVSS score or vendor remediation information is currently available.

The impact arises from the inclusion of vulnerable cryptographic library versions within Net::Dropbear, potentially exposing users to risks associated with CVE-2016-6129 and CVE-2018-12437. However, no specific exploitation details or active exploits have been reported. The lack of an official patch or remediation guidance means the vulnerability remains unaddressed in affected versions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider upgrading to Net::Dropbear version 0.14 or later if available, or manually updating the libtomcrypt dependency to a non-vulnerable version. Monitoring the vendor's communications for updates is recommended.