CVE-2025-13735 Overview
CVE-2025-13735 is an out-of-bounds read vulnerability [CWE-125] affecting ASR Micro's Lapwing_Linux firmware on ASR1903 and ASR3901 chipsets. The flaw resides in the nr_fw modules, specifically within the program file Code/nr_fw/DLP/src/NrCgi.C. Attackers with low-privileged network access can trigger the condition to read memory beyond intended buffer boundaries. The issue affects Lapwing_Linux builds released before November 26, 2025.
Critical Impact
Network-adjacent attackers with low privileges can read out-of-bounds memory, potentially disclosing sensitive data and impacting integrity and availability across a scope-changed boundary.
Affected Products
- ASR Micro ASR1903 (Lapwing_Linux firmware before 2025/11/26)
- ASR Micro ASR3901 (Lapwing_Linux firmware before 2025/11/26)
- nr_fw modules containing Code/nr_fw/DLP/src/NrCgi.C
Discovery Timeline
- 2025-11-26 - CVE-2025-13735 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-13735
Vulnerability Analysis
The vulnerability is an out-of-bounds read in the New Radio firmware (nr_fw) CGI handler implemented in NrCgi.C. The code path reads memory outside the bounds of an allocated buffer when processing input over the network. Because the attack vector is network-based and requires only low privileges with no user interaction, remote authenticated attackers in adjacent systems can reach the vulnerable parser. The scope-changed impact indicates that successful exploitation affects components beyond the vulnerable process itself.
The combination of low confidentiality, integrity, and availability impacts suggests the flaw can leak adjacent memory contents, corrupt downstream processing logic, or cause partial service disruption. Out-of-bounds reads in baseband and modem firmware are particularly concerning because exposed memory may contain cryptographic material, session tokens, or radio control state.
Root Cause
The root cause is missing or insufficient bounds checking in Code/nr_fw/DLP/src/NrCgi.C before reading from a memory region. The CGI handler likely accepts attacker-controlled length or offset values without validating them against the actual buffer size, allowing reads past the buffer's end. This is a classic [CWE-125] pattern in C code that parses structured network input.
Attack Vector
Exploitation requires network reachability to the affected ASR1903 or ASR3901 device and a low-privileged authenticated session. An attacker sends crafted requests to the nr_fw CGI interface, manipulating fields that influence the read operation in NrCgi.C. No verified public proof-of-concept is available at this time. Refer to the ASR Micro PSIRT advisory for vendor-supplied technical details.
Detection Methods for CVE-2025-13735
Indicators of Compromise
- Anomalous CGI requests targeting nr_fw endpoints on ASR1903 or ASR3901 devices
- Unexpected crashes, watchdog resets, or memory faults in the nr_fw process
- Outbound transfers of unusually structured response data from baseband management interfaces
Detection Strategies
- Inspect network traffic to administrative interfaces on ASR-based devices for malformed CGI parameters and oversized length fields.
- Enable verbose logging on the nr_fw module and alert on parser errors or repeated authentication followed by malformed requests.
- Correlate authenticated session activity with abnormal response sizes that may indicate memory disclosure.
Monitoring Recommendations
- Centralize device logs from ASR1903 and ASR3901 deployments into a SIEM for anomaly detection.
- Monitor for repeated low-privileged logins from a single source followed by CGI requests to nr_fw paths.
- Track firmware versions across the fleet and alert on devices still running Lapwing_Linux builds prior to 2025/11/26.
How to Mitigate CVE-2025-13735
Immediate Actions Required
- Inventory all ASR1903 and ASR3901 devices and identify those running Lapwing_Linux firmware released before 2025/11/26.
- Apply the firmware update referenced in the ASR Micro PSIRT advisory as soon as it is available for your platform.
- Restrict network access to device management and CGI interfaces to trusted administrative networks only.
Patch Information
ASR Micro indicates the issue is resolved in Lapwing_Linux builds dated 2025/11/26 or later. Consult the ASR Micro PSIRT page for vendor-specific firmware images and integration guidance for affected ASR1903 and ASR3901 platforms.
Workarounds
- Place affected devices behind a network segmentation boundary that blocks untrusted access to CGI management endpoints.
- Rotate credentials used to authenticate to nr_fw interfaces to reduce the window of exposure for low-privileged accounts.
- Disable unused management services on ASR1903 and ASR3901 devices until patched firmware is deployed.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
