CVE-2025-49480VulnerabilityPublished 1 Jul 2025Updated 26 Nov 2025

CVE-2025-49480: ASR Falcon_Linux、Kestrel、Lapwing_Linux · Out-of-bounds Read

Affects ASR Falcon_Linux、Kestrel、Lapwing_LinuxSource CVE Database V5

Not known to be exploited · CVSS 7.4 High.

Data as of 25 Oct 2026, 19:02 UTC

CVSS 3.1 base score

7.4High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Changed
Confidentiality: Low
Integrity: Low
Availability: Low

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: Low: The attacker is authorized with (i.e., requires) privileges that provide basic user capabilities that could normally affect only settings and files owned by a user. Alternatively, an attacker with Low privileges may have the ability to cause an impact only to non-sensitive resources.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Changed: An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.
Confidentiality: Low: There is some loss of confidentiality. Access to some restricted information is obtained, but the attacker does not have control over what information is obtained, or the amount or kind of loss is limited. The information disclosure does not cause a direct, serious loss to the impacted component.
Integrity: Low: Modification of data is possible, but the attacker does not have control over the consequence of a modification, or the amount of modification is limited. The data modification does not have a direct, serious impact on the impacted component.
Availability: Low: Performance is reduced or there are interruptions in resource availability. Even if repeated exploitation of the vulnerability is possible, the attacker does not have the ability to completely deny service to legitimate users. The resources in the impacted component are either partially available all of the time, or fully available only some of the time, but overall there is no direct, serious consequence to the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 1 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
ASR Falcon_Linux、Kestrel、Lapwing_Linux	Affected =0	Fixed in–

AI-suggested

1. Monitor ASR's official channels for patches or updates addressing CVE-2025-49480 and apply them promptly once available. 2. Until patches are released, implement strict network segmentation to isolate affected LTE telephony components from broader enterprise networks. 3. Employ intrusion detection and prevention systems (IDS/IPS) with signatures or heuristics targeting anomalous memory access or unusual traffic patterns related to LZMA compression operations. 4. Restrict access to vulnerable systems to trusted personnel and authenticated devices only, minimizing the attack surface. 5. Conduct thorough security audits and memory integrity checks on affected systems to detect exploitation attempts. 6. Engage with ASR support for any available workarounds or mitigations specific to the affected products. 7. Enhance logging and monitoring around telephony infrastructure to quickly identify suspicious activities. 8. Prepare incident response plans tailored to potential exploitation scenarios involving memory corruption or data leakage.

Description

Out-of-bounds access in ASR180x 、ASR190x in lte-telephony, This vulnerability is associated with program files apps/lzma/src/LzmaEnc.c. This issue affects Falcon_Linux、Kestrel、Lapwing_Linux: before v1536.

Impact

For European organizations, especially telecom operators and service providers using ASR's Falcon_Linux, Kestrel, and Lapwing_Linux platforms in their LTE telephony infrastructure, this vulnerability poses significant risks. Exploitation could lead to unauthorized disclosure of sensitive telephony data, disruption of LTE services, and potential compromise of network integrity. This can affect customer privacy, regulatory compliance (e.g., GDPR), and operational continuity. The vulnerability's ability to impact confidentiality, integrity, and availability simultaneously increases the risk profile. Additionally, service outages or data breaches could damage reputation and incur financial penalties. Given the critical role of LTE networks in communications, emergency services, and business operations, the impact extends beyond individual organizations to national infrastructure stability.

Summary

CVE-2025-49480 is an out-of-bounds read vulnerability classified under CWE-125, found in ASR's Falcon_Linux, Kestrel, and Lapwing_Linux products prior to version 1536. The vulnerability resides in the LTE telephony module, specifically within the LzmaEnc.c file, which is part of the LZMA compression encoder implementation. An out-of-bounds read occurs when the program accesses memory outside the intended buffer boundaries, potentially exposing sensitive data or causing undefined behavior. The vulnerability can be triggered remotely over the network (AV:N), requires low privileges (PR:L), and does not require user interaction (UI:N). The scope is changed (S:C), meaning exploitation can affect resources beyond the vulnerable component. The CVSS v3.1 base score is 7.4, indicating high severity, with impacts on confidentiality, integrity, and availability. Although no known exploits are reported in the wild, the vulnerability could be leveraged to leak sensitive information, corrupt memory leading to denial of service, or be a stepping stone for further attacks. The affected products are typically used in LTE telephony infrastructure, making telecom operators and related service providers prime targets. The lack of available patches at the time of publication necessitates immediate risk mitigation strategies.

CWE-125Out-of-bounds Read (opens in a new tab)
Base weaknessCWE Top 25 (2025): #8
The product reads data past the end, or before the beginning, of the intended buffer.
Implementation · Input Validation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
Architecture and Design · Language Selection
Use a language that provides appropriate memory abstractions.
OWASP Cheat Sheets
XML Security (opens in a new tab)
Mass Assignment (opens in a new tab)
OWASP ASVS 4.0.3
V13.3.1 (opens in a new tab)
V5.1.4 (opens in a new tab)
V5.1.3 (opens in a new tab)
Attack patterns
Overread Buffers (opens in a new tab)
From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

References

asrmicro.com/en/goods/psirt?cid=40 (opens in a new tab)

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Nov 2025, 06:52 UTC

WeaknessesCWE-125

Technical details

References

Community reviews

Related threats