CVE-2025-15638

OVERVIEW CVE-2025-15638 affects Net::Dropbear versions prior to 0.14 for Perl, which bundle a vulnerable version of the libtomcrypt cryptographic library (v1.18.1 or earlier). The vulnerability stems from the inclusion of deprecated Dropbear SSH server code (2019.78 or earlier) that contains libtomcrypt versions affected by two prior CVEs: CVE-2016-6129 and CVE-2018-12437. This represents a supply chain risk for Perl applications relying on Net::Dropbear for SSH functionality. SEVERITY This vulnerability carries a critical CVSS 3.1 score of 10.0, indicating maximum severity. The attack vector is network-based requiring no authentication or user interaction, with low attack complexity. An unauthenticated remote attacker could exploit this vulnerability over the network to achieve complete confidentiality, integrity, and availability compromises across the affected system and potentially connected systems. EXPLOITATION STATUS Currently, there is no indication of active exploitation in the wild, as the vulnerability does not appear on the KEV catalog and is listed as inactive on threat tracking systems. The EPSS score of 0.0001 suggests minimal exploitation likelihood at present. However, the critical CVSS rating and the age of the underlying libtomcrypt vulnerabilities warrant immediate patching of Net::Dropbear to version 0.14 or later.