CVE-2025-54770
Last modified
CVE-2025-54770 is a medium-severity vulnerability rated 4.9/10 on the CVSS scale. A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. EPSS estimates a 0.13% chance of exploitation in the next 30 days.
Description
A vulnerability has been identified in the GRUB2 bootloader's network module that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the net_set_vlan command is not properly unregistered when the network module is unloaded from memory. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability
Metrics
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-54770?
How severe is CVE-2025-54770?
How do I fix CVE-2025-54770?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-54765An API endpoint that should be limited to web application ad…5.3
- CVE-2025-54766An API endpoint that should be limited to web application ad…5.3
- CVE-2025-54767An authenticated, read-only user can kill any processes runn…6.5
- CVE-2025-54768An API endpoint that should be limited to web application ad…5.3
- CVE-2025-54769An authenticated, read-only user can upload a file and perfo…8.8
- CVE-2025-5477Sony XAV-AX8500 Bluetooth L2CAP Protocol Heap-based Buffer O…7.5
- CVE-2025-54771A use-after-free vulnerability has been identified in the GN…4.9
- CVE-2025-54777Uncaught exception issue exists in Multiple products in bizh…5.3
- CVE-2025-54778A reflected cross-site scripting (xss) vulnerability exists …5.4
- CVE-2025-5478Sony XAV-AX8500 Bluetooth SDP Protocol Integer Overflow Remo…8.8
- CVE-2025-54780The glpi-screenshot-plugin allows users to take screenshots …7.7
- CVE-2025-54781Himmelblau is an interoperability suite for Microsoft Azure …2.8
Are you affected by CVE-2025-54770?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST