{"id":"CVE-2025-13735","aliases":["EUVD-2025-199708","GHSA-8mjc-g2w7-fch8","ROOT-OS-UBUNTU-2204-CVE-2025-13735","UBUNTU-CVE-2025-13735"],"status":"published","title":"Out-of-bounds Read in nr flc","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00213,"percentile":0.11715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2025-11-26T06:02:49Z","modified":"2026-11-06T14:17:18Z","fixes":[{"ecosystem":"Root:Ubuntu:22.04","package":"linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]},{"ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","fixed_in":["5.15.0-203.213.aikido.119"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]},{"source":"osv","ecosystem":"Root:Ubuntu:22.04","package":"rootio-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.15.0-203.213.aikido.119"}]}]}],"products":[{"vendor":"asr","product":"lapwing_linux"}],"references":[{"url":"https://www.asrmicro.com/en/goods/psirt?cid=41","tags":["report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-13735"},{"url":"https://github.com/advisories/GHSA-8mjc-g2w7-fch8"},{"url":"https://ubuntu.com/security/CVE-2025-13735","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-13735","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-13735","title":"Out-of-bounds Read in nr flc","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.","status":"published","published":"2025-11-26T06:02:49.012Z","modified":"2025-11-26T14:54:15.319Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:32:43.437394Z"}],"euvd":[{"id":"EUVD-2025-199708","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.","status":"published","published":"2025-11-26T06:02:49Z","modified":"2025-11-26T14:54:15Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T19:49:12.440244Z"}],"ghsa":[{"id":"GHSA-8mjc-g2w7-fch8","title":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules)...","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.","status":"published","published":"2025-11-26T09:31:21Z","modified":"2025-11-26T09:31:21Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:04:58.071945Z"}],"nvd":[{"id":"CVE-2025-13735","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C.\n\nThis issue affects Lapwing_Linux: before 2025/11/26.","status":"published","published":"2025-11-26T07:16:00.173Z","modified":"2026-06-17T08:34:40.107Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:11:46.94029Z"}],"osv":[{"id":"UBUNTU-CVE-2025-13735","description":"Out-of-bounds Read vulnerability in ASR1903、ASR3901 in ASR Lapwing_Linux on Linux (nr_fw modules). This vulnerability is associated with program files Code/nr_fw/DLP/src/NrCgi.C. This issue affects Lapwing_Linux: before 2025/11/26.","status":"withdrawn","published":"2025-11-26T07:16:00Z","modified":"2026-10-21T23:01:44.344542221Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ROOT-OS-UBUNTU-2204-CVE-2025-13735","title":"CVE-2025-13735 in linux - Patched by Root","description":"Root has patched CVE-2025-13735 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.","status":"published","published":"2026-11-06T13:52:25Z","modified":"2026-11-06T14:17:18.361467882Z","updated_at":"2026-11-06T14:57:21.022388Z"}]}}