RRWO Net::CIDR::Set 0.10/0.11/0.12/0.13 on Perl IP CIDR Address String improper validation of specified type of input

Summaryinfo

A vulnerability was found in RRWO Net::CIDR::Set 0.10/0.11/0.12/0.13 on Perl. It has been rated as problematic. The affected element is an unknown function of the component IP CIDR Address String Handler. The manipulation leads to improper validation of specified type of input. This vulnerability is referenced as CVE-2025-40911. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in RRWO Net::CIDR::Set 0.10/0.11/0.12/0.13 on Perl and classified as problematic. This issue affects an unknown function of the component IP CIDR Address String Handler. The manipulation with an unknown input leads to a improper validation of specified type of input vulnerability. Using CWE to declare the problem leads to CWE-1287. The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type. Impacted is integrity. The summary by CVE is:

Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses. Leading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation. Net::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.

It is possible to read the advisory at metacpan.org. The identification of this vulnerability is CVE-2025-40911 since 04/16/2025. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 0.14 eliminates this vulnerability. The upgrade is hosted for download at metacpan.org. Applying the patch be7d91e8446ad8013b08b4be313d666dab003a8a is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• RRWO

Name

• Net::CIDR::Set

Version

• 0.10
• 0.11
• 0.12
• 0.13

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion