CVE-2025-15638: critical vulnerability in ATRODO Net::Dropbear
Net::Dropbear versions before 0.14 for Perl contains a vulnerable version of libtomcrypt
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Net::Dropbear, a Perl library for SSH connections, includes an outdated cryptographic library (libtomcrypt) with known security flaws that could allow attackers to compromise encrypted communications.
Net::Dropbear before version 0.14 bundles vulnerable libtomcrypt v1.18.1 or earlier, which contains flaws addressed in CVE-2016-6129 and CVE-2018-12437. These vulnerabilities in the cryptographic primitives can be exploited remotely through SSH protocol interactions to weaken or bypass encryption protections.
In the same product, most dangerous first.