SecuriTricks - CVE-2025-27810

Description

Mbed TLS before 2.28.10 and 3.x before 3.6.3, in some cases of failed memory allocation or hardware errors, uses uninitialized stack memory to compose the TLS Finished message, potentially leading to authentication bypasses such as replays.

Product(s) Impacted

Vendor	Product	Versions
Mbed	Mbedtls	<2.28.10, <3.6.3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-908

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	mbed	mbedtls	<2.28.10	/	/	/	/	/	/	/
a	mbed	mbedtls	<3.6.3	/	/	/	/	/	/	/

References

https://github.com/Mbed-TLS/mbedtls/releases

https://mbed-tls.readthedocs.io/en/latest/security-advisories/mbedtls-security-advisory-2025-03-2/

CVSS Score

5.4 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: HIGH
Privileges Required: NONE
Scope: CHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

View Vector String

Timeline

Published: March 25, 2025, 6:15 a.m.
Last Modified: March 25, 2025, 6:15 a.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2025-27810