CVE-2025-24970
Published: 10 February 2025
Summary
CVE-2025-24970 is a high-severity Improper Input Validation (CWE-20) vulnerability in Netapp Active Iq Unified Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 23.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of flaws such as the improper input validation in Netty's SslHandler that leads to native crashes from crafted packets.
Mandates validation of information inputs like specially crafted SSL packets to ensure they are properly handled and prevent native crashes due to CWE-20 improper input validation.
Provides protection against denial-of-service events, limiting the availability impact of native crashes triggered by remote attackers sending crafted packets.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables remote exploitation of improper input validation in SslHandler to trigger a native crash, directly facilitating application or system exploitation for denial of service (T1499.004).
NVD Description
Netty, an asynchronous, event-driven network application framework, has a vulnerability starting in version 4.1.91.Final and prior to version 4.1.118.Final. When a special crafted packet is received via SslHandler it doesn't correctly handle validation of such a packet in all cases…
more
which can lead to a native crash. Version 4.1.118.Final contains a patch. As workaround its possible to either disable the usage of the native SSLEngine or change the code manually.
Deeper analysisAI
CVE-2025-24970 is a vulnerability in Netty, an asynchronous, event-driven network application framework for Java. It affects versions starting from 4.1.91.Final up to but not including 4.1.118.Final. The issue occurs in the SslHandler component, where a specially crafted packet is not correctly validated in all cases, leading to a native crash. This is classified under CWE-20 (Improper Input Validation) with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
The vulnerability can be exploited remotely over the network by unauthenticated attackers with low complexity and no user interaction required. By sending a specially crafted packet to a service using the vulnerable SslHandler, an attacker can trigger a native crash, resulting in denial-of-service through high availability impact, while confidentiality and integrity remain unaffected.
Mitigation is available in Netty version 4.1.118.Final, which includes a patch. As workarounds, organizations can disable the use of the native SSLEngine or manually modify the code. Detailed patch information is in the GitHub commit (87f40725155b2f89adfde68c7732f97c153676c4) and security advisory (GHSA-4g8c-wm8x-jfhw), with additional guidance from NetApp advisory ntap-20250221-0005 and Vicarius resources on detection and mitigation.
Details
- CWE(s)