CVE-2025-49480
📋 TL;DR
This CVE describes an out-of-bounds memory access vulnerability in the LZMA compression library used in ASR180x and ASR190x LTE telephony modules. Attackers could potentially read or write beyond allocated memory boundaries, leading to crashes or arbitrary code execution. The vulnerability affects Falcon_Linux, Kestrel, and Lapwing_Linux systems before version 1536.
💻 Affected Systems
- Falcon_Linux
- Kestrel
- Lapwing_Linux
📦 What is this software?
Falcon Linux by Asrmicro
Kestrel by Asrmicro
Lapwing Linux by Asrmicro
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or device takeover
Likely Case
Denial of service through system crashes or instability
If Mitigated
Limited impact with proper memory protection mechanisms and exploit mitigations
🎯 Exploit Status
Exploitation requires specific conditions and knowledge of the LTE telephony stack
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1536
Vendor Advisory: https://www.asrmicro.com/en/goods/psirt?cid=40
Restart Required: Yes
Instructions:
1. Download v1536 update from vendor 2. Apply update following vendor documentation 3. Restart affected systems 4. Verify update applied successfully
🔧 Temporary Workarounds
Disable vulnerable LZMA compression
linuxDisable LZMA compression features in LTE telephony stack if not required
# Configuration changes depend on specific system implementation
Network segmentation
allIsolate affected LTE telephony systems from untrusted networks
🧯 If You Can't Patch
- Implement strict network access controls to limit exposure
- Monitor systems for abnormal behavior and crashes
🔍 How to Verify
Check if Vulnerable:
Check system version: if running Falcon_Linux, Kestrel, or Lapwing_Linux before v1536, system is vulnerableCheck Version:
cat /etc/os-release | grep VERSION_IDVerify Fix Applied:
Verify system version is v1536 or later and check for absence of crashes in lte-telephony services📡 Detection & Monitoring
Log Indicators:
- Segmentation faults in lte-telephony processes
- Memory access violation errors
- Unexpected process crashes
Network Indicators:
- Abnormal LTE telephony protocol traffic
- Unexpected connections to telephony services
SIEM Query:
process.name: "lte-telephony" AND (event.type: "segmentation_fault" OR event.type: "memory_violation")