CVE-2025-13609
Raw vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:LSummary
CVE-2025-13609 is a high-severity Use of Multiple Resources with Duplicate Identifier (CWE-694) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, ranked at the 35th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-4 (Identifier Management) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-13609 is a vulnerability in keylime that allows an attacker to register a new agent using a different Trusted Platform Module (TPM) device while claiming the unique identifier (UUID) of an existing legitimate agent. This overwrites the legitimate agent's identity, enabling the attacker to impersonate the agent and potentially bypass security controls that rely on agent identity verification. Published on 2025-11-24, the issue is scored 8.2 under CVSS v3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) and maps to CWE-694.
The attack requires network access, low complexity, no user interaction, and high privileges (PR:H), with a scope change (S:C). A privileged attacker can exploit this by performing the malicious registration, achieving high integrity impact (I:H) through impersonation, along with low confidentiality (C:L) and availability (A:L) impacts, potentially undermining keylime's attestation and integrity measurement mechanisms.
Red Hat has issued multiple errata addressing CVE-2025-13609, including RHSA-2025:23201, RHSA-2025:23210, RHSA-2025:23628, RHSA-2025:23735, and RHSA-2025:23852, which provide mitigations such as updated keylime packages for affected Red Hat products.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-198980
Vulnerability Data
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate…
more
agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V8.4.1V3.5.4V6.8.1V9.2.4
Mitigating Controls (NIST 800-53 r5) AI
Identifier management directly requires authorization and uniqueness controls that stop duplicate resource identifiers from being assigned or used.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Maintaining software/service inventories requires and enforces unique identifiers to avoid collisions.
Managing identities and credentials for users/services/hardware directly requires unique identifiers.
Lifecycle management of assets includes identifier uniqueness as a supporting practice.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect duplicate identifiers before deployment.
Identity management processes that enforce unique identifiers directly prevent duplicate resource IDs.
Secure development lifecycle practices can catch duplicate-ID issues during design and code review.
Secure coding standards can mandate unique identifier generation and validation.
Configuration management ensures unique identifiers are assigned and maintained across resources.