CVE-2025-13609
Published: 24 November 2025
Summary
CVE-2025-13609 is a high-severity Use of Multiple Resources with Duplicate Identifier (CWE-694) vulnerability. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Impersonation (T1684.001); ranked at the 26.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-3 (Device Identification and Authentication).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Ensures unique management of identifiers like UUIDs to prevent their reuse or overwriting by agents with different TPM devices.
Requires robust device identification and authentication tied to specific TPM hardware, blocking impersonation attempts during agent registration.
Manages agent accounts including registration, validation, and deactivation to authorize only legitimate agent identities and prevent overwrites.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability directly enables impersonation of legitimate Keylime agents by overwriting their UUID registration with a different TPM (T1656), facilitating the abuse of valid agent accounts/identities (T1078) and exploitation for defense evasion by bypassing attestation security controls (T1211).
NVD Description
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent's unique identifier (UUID). This action overwrites the legitimate…
more
agent's identity, enabling the attacker to impersonate the compromised agent and potentially bypass security controls.
Deeper analysisAI
CVE-2025-13609 is a vulnerability in keylime that allows an attacker to register a new agent using a different Trusted Platform Module (TPM) device while claiming the unique identifier (UUID) of an existing legitimate agent. This overwrites the legitimate agent's identity, enabling the attacker to impersonate the agent and potentially bypass security controls that rely on agent identity verification. Published on 2025-11-24, the issue is scored 8.2 under CVSS v3.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L) and maps to CWE-694.
The attack requires network access, low complexity, no user interaction, and high privileges (PR:H), with a scope change (S:C). A privileged attacker can exploit this by performing the malicious registration, achieving high integrity impact (I:H) through impersonation, along with low confidentiality (C:L) and availability (A:L) impacts, potentially undermining keylime's attestation and integrity measurement mechanisms.
Red Hat has issued multiple errata addressing CVE-2025-13609, including RHSA-2025:23201, RHSA-2025:23210, RHSA-2025:23628, RHSA-2025:23735, and RHSA-2025:23852, which provide mitigations such as updated keylime packages for affected Red Hat products.
Details
- CWE(s)