CVE-2025-5072: 
NixOS vulnerability analysis and mitigation

CVE-2025-5072 is a resource leak vulnerability in the con_mgr component of ASR Micro's ASR180x and ASR190x hardware platforms. It affects the Falcon_Linux, Kestrel, and Lapwing_Linux operating systems in versions prior to v1536. The vulnerability allows resource leak exposure that can reduce system availability. It was published on July 1, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (ASR PSIRT).

The root cause is classified as CWE-404 (Improper Resource Shutdown or Release), where the con_mgr component on ASR180x and ASR190x platforms fails to properly release resources under certain conditions. This can be triggered remotely over the network without authentication (AV:N, AC:L, PR:N), making it accessible to unauthenticated network-adjacent attackers. The flaw maps to attack patterns including resource flooding and exhaustion (CAPEC-125, CAPEC-130, CAPEC-131), suggesting that repeated or malformed connection requests to the connection manager may trigger the leak (ASR PSIRT).

Successful exploitation results in a partial reduction of system availability due to resource exhaustion within the con_mgr component; there is no impact on confidentiality or integrity per the CVSS scoring. Prolonged exploitation could degrade or disrupt services running on affected ASR180x/ASR190x-based devices. The scope is limited to the affected device and does not facilitate lateral movement or significant data exposure (ASR PSIRT).

There is no public proof-of-concept exploit available, and no evidence of active in-the-wild exploitation has been observed. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037%, indicating a very low probability of exploitation in the near term (ASR PSIRT).

ASR Micro has released a patch addressing this vulnerability; affected users should upgrade Falcon_Linux, Kestrel, and Lapwing_Linux to version v1536 or later. As interim measures, administrators should restrict network access to affected ASR180x/ASR190x devices, implement least-privilege access controls, and monitor system resource consumption for anomalies. The vendor advisory is available through the ASR PSIRT portal (ASR PSIRT).