Medium – 4.6
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

PT-2025-17: Unrestricted memory access to internal memory of networking adapter in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family

Error type:

Vulnerability vector:

  • Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
  • Severity (CVSSv4.0): 4.6 (medium)

Description:

The vulnerability was identified in Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family, versions 231.1.162.1 (package version), 1.10.3 (hwrm spec).

The discovered vulnerability is related to improper access control to the network adapter memory read/write debug functions.

Vulnerability status: Confirmed by vendor

Date of vulnerability remediation: 10.04.2025

Recommendations:

  • Update the firmware to 2.33 or higher

Researcher: Alexey Kovrizhnykh (Positive Technologies)

Identifiers:

BDU:2025-01796

Vendor:

Broadcom

Vulnerable product:

Broadcom P225p NetXtreme-E Dual-port 10Gb/25Gb Ethernet PCIe Adapter, Broadcom NetXtreme-E family

Vulnerable versions:

231.1.162.1 (package version), 1.10.3 (hwrm spec)