Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2025-52890

Good to know:

icon

Date: June 25, 2025

Incus is a system container and virtual machine manager. When using an ACL on a device connected to a bridge, Incus versions 6.12 and 6.13generates nftables rules that partially bypass security options "security.mac_filtering", "security.ipv4_filtering" and "security.ipv6_filtering". This can lead to ARP spoofing on the bridge and to fully spoof another VM/container on the same bridge. Commit 254dfd2483ab8de39b47c2258b7f1cf0759231c8 contains a patch for the issue.

Severity Score

Related Resources (5)

https://github.com/lxc/incus/security/advisories/GHSA-p7fw-vjjm-2rwp
https://github.com/lxc/incus/commit/254dfd2483ab8de39b47c2258b7f1cf0759231c8
https://nvd.nist.gov/vuln/detail/CVE-2025-52890
https://github.com/lxc/incus
https://www.mend.io/vulnerability-database/CVE-2025-52890

Severity Score

Weakness Type (CWE)

Incorrect Authorization

CWE-863

Top Fix

icon

Upgrade Version

Upgrade to version https://github.com/lxc/incus.git - v6.14.0

Learn More

CVSS v3.1

Base Score:
Attack Vector (AV): ADJACENT_NETWORK
Attack Complexity (AC): LOW
Privileges Required (PR): HIGH
User Interaction (UI): NONE
Scope (S): CHANGED
Confidentiality (C): HIGH
Integrity (I): NONE
Availability (A): HIGH

Do you need more information?

Contact Us