Cyber Resilience

CVE-2025-40910

Medium

Published: 27 June 2025

Published
27 June 2025
Modified
15 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
EPSS Score 0.0026 49.5th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-40910 is a medium-severity Improper Validation of Specified Type of Input (CWE-1287) vulnerability. Its CVSS base score is 6.5 (Medium).

Operationally, ranked at the 49.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

Net::IP::LPM version 1.10 for Perl does not properly consider leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which…

more

can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.

CWE(s)
CWE-1287

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

—
LPM
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References