Security readout for executives and security teams
Plain-English summary
CVE-2025-40910 affects Perl module Net::IP::LPM version 1.10. It may misread IP/CIDR strings containing leading zeroes, which can cause IP-based allow or deny rules to make the wrong decision. Business risk is mainly unauthorized access where this library is trusted for access control.
Executive priority
Treat as a targeted medium-priority fix. Prioritize internet-facing or security-sensitive services that rely on this Perl module for IP-based access rules. If the module is only present but not used for access control, urgency is lower.
Technical view
Net::IP::LPM 1.10 does not properly consider leading zero characters in IP CIDR address strings. Because leading zeroes can imply octal notation, address parsing can diverge from operator expectations. The CVSS 3.1 score is 6.5, network-accessible, low complexity, no privileges, no user interaction, with low confidentiality and integrity impact.
Likely exposure
Exposure is limited to systems using Net::IP::LPM version 1.10, especially where it evaluates client IPs or CIDR ranges for authorization, filtering, or routing decisions. The CVE record lists default status as unaffected outside the named version.
Exploitation context
No active exploitation is indicated in the provided sources, and the CVE is not listed as KEV. Exploitation would require an application path where attacker-controlled or relevant IP/CIDR strings with leading zeroes influence access-control decisions.
Researcher notes
The issue is a parser/validation weakness tied to octal interpretation ambiguity. Sources provide an issue tracker entry and a security patch, but no confirmed fixed release is named in the bundle. Avoid assuming exploit availability or broad product impact beyond Net::IP::LPM 1.10.
Mitigation direction
- Identify Perl applications depending on Net::IP::LPM version 1.10.
- Review whether the module is used for IP-based access control decisions.
- Evaluate and apply the referenced MetaCPAN security patch through normal change control.
- Check the RT CPAN ticket and CVE record for fixed-release guidance.
- Add input normalization or rejection of ambiguous leading-zero IP notation where appropriate.
Validation and detection
- Inventory Perl dependencies and confirm Net::IP::LPM version usage.
- Trace application code paths that call Net::IP::LPM for allowlist or denylist logic.
- Test access-control behavior with ambiguous leading-zero IP/CIDR representations in a safe environment.
- Confirm patched code handles leading-zero inputs consistently with intended policy.
- Review logs for unusual access-control decisions involving ambiguous IP formatting.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-1287: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-40910 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N3.92.5CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://metacpan.org/release/TPODER/Net-IP-LPM-1.10/diff/TPODER/Net-IP-LPM-1.09/lib/Net/IP/LPM.pmCVE reference, CPANSec
- https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros/CVE reference, CPANSec
- https://security.metacpan.org/patches/N/Net-IP-LPM/1.10/CVE-2025-40910-r1.patchCVE reference, CPANSec · patch
- https://rt.cpan.org/Ticket/Display.html?id=179855CVE reference, CPANSec · issue-tracking, vendor-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.