CVE-2025-49488: 
NixOS vulnerability analysis and mitigation

CVE-2025-49488 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting ASR Micro's ASR180x and ASR190x chipset-based router components. The flaw resides in the router phonebook component (router/phonebook/pb.c) and allows unauthenticated network attackers to cause resource leak exposure. Affected firmware platforms are Falcon_Linux, Kestrel, and Lapwing_Linux versions prior to v1536. It was published on July 1, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (ASR PSIRT, ENISA EUVD).

The vulnerability is classified as CWE-404 (Improper Resource Shutdown or Release), meaning the affected code in router/phonebook/pb.c fails to properly release or close resources — such as file descriptors, memory allocations, or sockets — under certain conditions. This resource leak can be triggered remotely over the network without authentication or user interaction, as the attack vector is network-accessible with low complexity. The flaw is specific to the router phonebook component on ASR180x and ASR190x hardware platforms running the affected firmware builds (ASR PSIRT, ENISA EUVD).

Successful exploitation results in resource leak exposure, leading to gradual resource exhaustion on the affected router. The primary impact is a low reduction in availability — the device may experience performance degradation or partial service disruption over time as leaked resources accumulate. Confidentiality and integrity are not directly impacted per the CVSS assessment, though the ENISA scoring notes a low confidentiality exposure under certain conditions. The vulnerability does not enable code execution or privilege escalation (ASR PSIRT, ENISA EUVD).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.037%, reflecting a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (ASR PSIRT, ENISA EUVD).

ASR Micro has released a patch addressing this vulnerability. Operators should upgrade affected firmware (Falcon_Linux, Kestrel, Lapwing_Linux) to version v1536 or later. As interim mitigations, network segmentation should be applied to restrict access to router management interfaces, and system resource utilization should be monitored for unusual consumption patterns indicative of resource leaks (ASR PSIRT).