CVE-2025-49489: 
NixOS vulnerability analysis and mitigation

CVE-2025-49489 is an Improper Resource Shutdown or Release vulnerability (CWE-404) affecting ASR's Falcon_Linux, Kestrel, and Lapwing_Linux operating systems on Linux platforms. The flaw resides in the con_mgr component, specifically in the con_mgr/dialer_task.C program file, and allows resource leak exposure. All versions prior to v1536 are affected. It was published on July 1, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (ASR PSIRT).

The vulnerability is classified under CWE-404 (Improper Resource Shutdown or Release), meaning the software fails to properly release or shut down resources when they are no longer needed. The affected code is located in con_mgr/dialer_task.C, a component of the connection manager (con_mgr) subsystem. An unauthenticated remote attacker can trigger the resource leak over the network without user interaction, potentially exhausting system resources over time. No authentication or special privileges are required to initiate the attack (ASR PSIRT).

Successful exploitation results in resource leak exposure, leading to partial degradation of system availability. The primary impact is a low-severity availability reduction due to resource exhaustion; there is no direct impact on confidentiality or data integrity per the NVD CVSS vector. The vulnerability could cause partial system disruption on affected ASR Linux-based devices if repeatedly triggered, but does not enable code execution or privilege escalation (ASR PSIRT).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed. The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack vector is network-accessible with no authentication required, but the low impact and lack of weaponization reduce overall risk (ASR PSIRT).

ASR has released a patch addressing this vulnerability; affected products (Falcon_Linux, Kestrel, and Lapwing_Linux) should be updated to version v1536 or later. As interim measures, administrators should implement network access controls to restrict unnecessary network access to affected devices, and monitor system resource consumption for unusual patterns. A review of con_mgr components, particularly dialer_task.C, is also recommended (ASR PSIRT).