CVE-2025-25066
📋 TL;DR
CVE-2025-25066 is a stack-based buffer overflow vulnerability in nDPI's address cache restoration function. This could allow attackers to execute arbitrary code or cause denial of service on systems using vulnerable nDPI versions. Organizations using nDPI for network traffic analysis or DPI functionality are affected.
💻 Affected Systems
- nDPI (ntop Deep Packet Inspection)
📦 What is this software?
Ndpi by Ntop
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or persistent backdoor installation.
Likely Case
Denial of service causing nDPI process crashes and disruption of network monitoring/traffic analysis capabilities.
If Mitigated
Limited impact with proper memory protection mechanisms (ASLR, stack canaries) and privilege separation.
🎯 Exploit Status
Exploitation requires sending specially crafted network traffic that triggers the cache restoration function with malicious data.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after commit 678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb
Vendor Advisory: https://github.com/ntop/nDPI/commit/678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb
Restart Required: No
Instructions:
1. Update nDPI to latest version or apply commit 678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb
2. Recompile any applications using nDPI
3. Redeploy updated applications
🔧 Temporary Workarounds
Disable address cache
allConfigure applications to not use nDPI's address cache functionality if possible
🧯 If You Can't Patch
- Implement network segmentation to limit traffic reaching nDPI systems
- Deploy memory protection controls (ASLR, stack canaries, DEP) on affected systems
🔍 How to Verify
Check if Vulnerable:
Check nDPI version: ndpi-config --version or examine source code for commit 678697b5eb6c3caa5dd5f8cccfe9eed8d13b94bb presenceCheck Version:
ndpi-config --versionVerify Fix Applied:
Verify nDPI version is newer than 4.12 or contains the fix commit📡 Detection & Monitoring
Log Indicators:
- nDPI process crashes
- segmentation fault errors in application logs
Network Indicators:
- Unusual traffic patterns triggering cache operations
- Repeated connection attempts to nDPI services
SIEM Query:
process_name:"ndpi" AND (event_type:crash OR error_message:"segmentation fault")