CVE-2025-62525: OpenWrt Privilege Escalation Vulnerability

CVE-2025-62525 Overview

CVE-2025-62525 is a local privilege escalation vulnerability in the OpenWrt ltq-ptm driver. The driver powers the datapath of Digital Subscriber Line (DSL) connections in Packet Transfer Mode (PTM) on Lantiq, Intel, and MaxLinear System-on-Chip (SoC) platforms. Local users can invoke driver ioctl calls to read and write arbitrary kernel memory. OpenWrt typically runs as a single-user system, but some services execute inside ujail sandboxes. This flaw permits attackers to escape those containers and gain full kernel-level control. The issue affects the lantiq target with xrx200, danube, and amazon SoCs running DSL in PTM mode, which covers most VDSL deployments. OpenWrt versions prior to 24.10.4 are affected.

Critical Impact
Sandbox escape via arbitrary kernel memory read and write from an unprivileged local context on affected Lantiq-based DSL routers.

Affected Products

OpenWrt versions prior to 24.10.4
Lantiq target builds using xrx200, danube, and amazon SoCs with DSL in PTM mode
Devices using the ltq-ptm driver (most VDSL deployments); ADSL/ATM mode and the VRX518 driver are not affected

Discovery Timeline

2025-10-22 - CVE-2025-62525 published to the National Vulnerability Database (NVD)
2025-10-22 - OpenWrt publishes advisory 2025-10-22-2 and releases fix in version 24.10.4
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-62525

Vulnerability Analysis

The vulnerability resides in the ltq-ptm kernel driver, which manages the PTM datapath for DSL lines on Lantiq-family SoCs. The driver exposes ioctl interfaces that fail to validate input parameters correctly, mapped to [CWE-20: Improper Input Validation]. Local users can craft ioctl requests that direct the driver to read from or write to attacker-chosen kernel memory addresses.

Because OpenWrt runs services such as network daemons inside ujail sandboxes, this primitive breaks the boundary between constrained services and the kernel. An attacker with code execution in a sandboxed service can pivot to full kernel compromise. Arbitrary kernel write allows credential structure modification, syscall table tampering, and disabling of security mitigations.

Root Cause

The root cause is missing validation of user-supplied pointers and length fields passed through ioctl handlers in ifxmips_ptm_adsl.c. The driver treats attacker-controlled values as trusted kernel pointers when performing internal memory operations. The upstream fix in commits 2a76abc5442e3f74d95b4caa9bb57e5488fc132e and e001b31163a77683ee741d169f794cfa50926f37 restricts the affected ioctl and debugfs paths.

Attack Vector

Exploitation requires local access with low privileges on an affected device, no user interaction, and low attack complexity. A malicious process, including one running inside a ujail sandbox, opens the ltq-ptm device node and issues crafted ioctl calls. Successful exploitation yields arbitrary kernel read/write, enabling sandbox escape and privilege escalation to root-equivalent kernel context.

text

--- a/ifxmips_ptm_adsl.c
+++ b/ifxmips_ptm_adsl.c
@@ -175,9 +175,11 @@ static INLINE void mailbox_signal(unsign
  */
 static INLINE void proc_file_create(void);
 static INLINE void proc_file_delete(void);

@@ -180,7 +180,7 @@ static int proc_read_version(char *, cha
 static int proc_read_wanmib(char *, char **, off_t, int, int *, void *);
 static int proc_write_wanmib(struct file *, const char *, unsigned long, void *);
 #endif

Source: OpenWrt commit 2a76abc and commit e001b31. The patches modify ltq-ptm compilation and debugfs handling to remove the unsafe kernel memory exposure.

Detection Methods for CVE-2025-62525

Indicators of Compromise

Unexpected ioctl activity against ltq-ptm device nodes from non-root or sandboxed processes
Kernel oops or panic messages referencing ifxmips_ptm_adsl in dmesg output
Processes escaping ujail confinement and executing with elevated capabilities on Lantiq targets
Unauthorized changes to /etc/passwd, /etc/shadow, or firewall rules on affected DSL routers

Detection Strategies

Audit which processes have access to the ltq-ptm character device and correlate with expected DSL management daemons
Monitor kernel logs for warnings or faults originating in the ltq-ptm module during ioctl handling
Inventory OpenWrt devices to identify units running versions prior to 24.10.4 on Lantiq xrx200, danube, or amazon SoCs in PTM mode

Monitoring Recommendations

Forward OpenWrt logread output to a central log aggregator and alert on kernel-level anomalies from the DSL subsystem
Track firmware versions across the fleet to confirm all affected devices have been upgraded to 24.10.4 or later
Alert on new binaries or persistence artifacts appearing on read-only OpenWrt partitions

How to Mitigate CVE-2025-62525

Immediate Actions Required

Upgrade all affected OpenWrt devices to version 24.10.4 or later, which contains the official fix
Identify devices using DSL in PTM mode on Lantiq xrx200, danube, or amazon SoCs and prioritize them for patching
Restrict local shell and service access on affected routers to trusted administrators only
Review sandboxed services for exposure to the ltq-ptm device node and remove unnecessary access

Patch Information

The fix is included in OpenWrt 24.10.4. Reference the OpenWrt Security Advisory 2025-10-22-2 and the GitHub Security Advisory GHSA-h427-frpr-7cqr for details. The upstream commits 2a76abc5442e3f74d95b4caa9bb57e5488fc132e and e001b31163a77683ee741d169f794cfa50926f37 apply the kernel patches to the ltq-ptm package.

Workarounds

No workarounds are available according to the vendor advisory; upgrading to OpenWrt 24.10.4 is required
Operators unable to upgrade immediately should isolate affected devices at the network layer and disable non-essential local services

bash

# Verify OpenWrt version and upgrade to the fixed release
cat /etc/openwrt_release | grep DISTRIB_RELEASE

# Download and apply the 24.10.4 sysupgrade image for the lantiq target
cd /tmp
wget https://downloads.openwrt.org/releases/24.10.4/targets/lantiq/xrx200/openwrt-24.10.4-lantiq-xrx200-<device>-squashfs-sysupgrade.bin
sysupgrade -v /tmp/openwrt-24.10.4-lantiq-xrx200-<device>-squashfs-sysupgrade.bin