CVE-2025-25962
Published: 29 April 2025
Summary
CVE-2025-25962 is a critical-severity Improper Privilege Management (CWE-269) vulnerability. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 19.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An issue in Coresmartcontracts Uniswap version 3.0, fixed in version 4.0, permits remote privilege escalation through the _modifyPosition function. The vulnerability is tracked under CWE-269 and CWE-284 and carries a CVSS 3.1 score of 9.8, reflecting network-accessible attack conditions with no required authentication or user interaction and full impact on confidentiality, integrity, and availability.
A remote attacker can invoke the affected function to escalate privileges and obtain unauthorized control over contract state and assets. The attack requires no prior credentials, enabling an unauthenticated party to modify positions and potentially compromise funds or contract behavior in the Uniswap v3 deployment.
The provided references indicate the flaw was addressed by upgrading to Uniswap v4.0; no additional configuration changes or workarounds are documented in the available sources.
EPSS scores remain low, with a current value of 0.0131 and a peak of 0.0168, showing no material post-disclosure increase that would indicate emerging exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12645
Vulnerability details
An issue in Coresmartcontracts Uniswap v.3.0 and fixed in v.4.0 allows a remote attacker to escalate privileges via the _modifyPosition function
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
The access control policy and procedures directly mandate and enforce proper access control mechanisms across the organization.
Supervision and review of access control activities directly detects and remediates improper access configurations or usages.
Defining account types, requiring approvals for creation, specifying authorizations, monitoring usage, and reviewing accounts directly prevents improper access control by ensuring only authorized accounts exist and are used.
Provides a tamperproof, always-invoked, and verifiable mechanism to enforce access control policies.
By mandating division of duties across roles, the control enforces proper privilege management and prevents a single entity from controlling an entire sensitive process.
Implements core proper privilege management by restricting to only required rights.
The awareness and training policy mandates training on access control practices, directly reducing the likelihood of improper access control weaknesses being introduced or exploited.
Training covers proper privilege management practices, making incorrect privilege assignments less likely.