CVE-2025-13735 - Vulnerability Details - OpenCVE

Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Asrmicro	Asr1903 Asr3901

No data.

No data.

References

Link	Providers
https://www.asrmicro.com/en/goods/psirt?cid=41

History

Fri, 28 Nov 2025 09:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Asrmicro Asrmicro asr1903 Asrmicro asr3901
Vendors & Products		Asrmicro Asrmicro asr1903 Asrmicro asr3901

Wed, 26 Nov 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 26 Nov 2025 06:30:00 +0000

Type	Values Removed	Values Added
Description		Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26.
Title		Out-of-bounds Read in nr flc
Weaknesses		CWE-125
References		https://www.asrmicro.com/en/goods/psirt?cid=41
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L'}`

MITRE

Status: PUBLISHED

Assigner: ASR

Published: 2025-11-26T06:02:49.012Z

Updated: 2025-11-26T14:54:15.319Z

Reserved: 2025-11-26T04:22:02.407Z

Link: CVE-2025-13735

Vulnrichment

Updated: 2025-11-26T14:54:10.738Z

NVD

Status : Awaiting Analysis

Published: 2025-11-26T07:16:00.173

Modified: 2025-12-01T15:39:53.100

Link: CVE-2025-13735

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13735", "assignerOrgId": "68630edc-a58c-4cbd-9b01-0e130455c8ae", "state": "PUBLISHED", "assignerShortName": "ASR", "dateReserved": "2025-11-26T04:22:02.407Z", "datePublished": "2025-11-26T06:02:49.012Z", "dateUpdated": "2025-11-26T14:54:15.319Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "modules": ["nr_fw"], "platforms": ["Linux"], "product": "Lapwing_Linux", "programFiles": ["Code/nr_fw/DLP/src/NrCgi.c"], "vendor": "ASR", "versions": [{"lessThan": "2025/11/26", "status": "affected", "version": "0", "versionType": "date"}]}], "datePublic": "2025-11-26T05:43:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Out-of-bounds Read vulnerability in ASR1903\u3001ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules).<p> This vulnerability is associated with program files <tt>Code/nr_fw/DLP/src/NrCgi.C</tt>.</p><p>This issue affects Lapwing_Linux: before 2025/11/26.</p>"}], "value": "Out-of-bounds Read vulnerability in ASR1903\u3001ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "68630edc-a58c-4cbd-9b01-0e130455c8ae", "shortName": "ASR", "dateUpdated": "2025-11-26T06:07:08.016Z"}, "references": [{"url": "https://www.asrmicro.com/en/goods/psirt?cid=41"}], "source": {"discovery": "UNKNOWN"}, "title": "Out-of-bounds Read in nr flc", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-26T14:53:54.612429Z", "id": "CVE-2025-13735", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:54:15.319Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-26T14:53:54.612429Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-26T14:54:10.738Z"}}], "cna": {"title": "Out-of-bounds Read in nr flc", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ASR", "modules": ["nr_fw"], "product": "Lapwing_Linux", "versions": [{"status": "affected", "version": "0", "lessThan": "2025/11/26", "versionType": "date"}], "platforms": ["Linux"], "programFiles": ["Code/nr_fw/DLP/src/NrCgi.c"], "defaultStatus": "unaffected"}], "datePublic": "2025-11-26T05:43:00.000Z", "references": [{"url": "https://www.asrmicro.com/en/goods/psirt?cid=41"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "Out-of-bounds Read vulnerability in ASR1903\u3001ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.", "supportingMedia": [{"type": "text/html", "value": "Out-of-bounds Read vulnerability in ASR1903\u3001ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules).<p> This vulnerability is associated with program files <tt>Code/nr_fw/DLP/src/NrCgi.C</tt>.</p><p>This issue affects Lapwing_Linux: before 2025/11/26.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125 Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "68630edc-a58c-4cbd-9b01-0e130455c8ae", "shortName": "ASR", "dateUpdated": "2025-11-26T06:07:08.016Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13735", "state": "PUBLISHED", "dateUpdated": "2025-11-26T14:54:15.319Z", "dateReserved": "2025-11-26T04:22:02.407Z", "assignerOrgId": "68630edc-a58c-4cbd-9b01-0e130455c8ae", "datePublished": "2025-11-26T06:02:49.012Z", "assignerShortName": "ASR"}, "dataVersion": "5.2"}