What is the CVSS score of CVE-2025-54349?

CVE-2025-54349 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of Iperf3 are affected by CVE-2025-54349?

Organizations using iperf should be aware of notable risk from CVE-2025-54349 rated CVSS 6.5. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-54349?

Within 30 days: Identify affected systems running iperf and apply vendor patches as part of regular patch cycle. Vendor patch is available.

Iperf3 CVE-2025-54349

MEDIUM

Off-by-one Error (CWE-193)

2025-08-03 cve@mitre.org

Buffer Overflow Iperf3 Red Hat Suse

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

SUSE

MEDIUM

qualitative

Red Hat

6.5 MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 19:05 vuln.today

Patch released

Mar 28, 2026 - 19:05 nvd

Patch available

CVE Published

Aug 03, 2025 - 02:15 nvd

MEDIUM 6.5

DescriptionCVE.org

In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow.

AnalysisAI

In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required.

Technical ContextAI

This vulnerability is classified under CWE-193. In iperf before 3.19.1, iperf_auth.c has an off-by-one error and resultant heap-based buffer overflow. Affected products include: Es Iperf3. Version information: before 3.19.1.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Iperf3

View all

CVE-2016-4303 CRITICAL Act Now POC

9.8 Sep 26

The parse_string function in cjson.c in the cJSON library mishandles UTF8/16 strings, which allows remote attackers to c

CVE-2024-53580 HIGH This Week POC

7.5 Dec 18

iperf v3.17.1 was discovered to contain a segmentation violation via the iperf_exchange_parameters() function. Rated hig

CVE-2023-38403 HIGH This Week

7.5 Jul 17

iperf3 before 3.14 allows peers to cause an integer overflow and heap corruption via a crafted length field. Rated high

CVE-2024-26306 MEDIUM This Month

5.9 May 14

iPerf3 before 3.17, when used with OpenSSL before 3.2.0 as a server with RSA authentication, allows a timing side channe

CVE-2025-54351 HIGH This Month

8.9 Aug 03

In iperf before 3.19.1, net.c has a buffer overflow when --skip-rx-copy is used (for MSG_TRUNC in recv). Rated high seve

CVE-2025-54350 LOW Monitor

3.7 Aug 03

In iperf before 3.19.1, iperf_auth.c has a Base64Decode assertion failure and application exit upon a malformed authenti

Same weakness CWE-193 – Off-by-one Error

View all

CVE-2021-3156 HIGH POC

7.8

CVE-2022-34970 CRITICAL POC

9.8

CVE-2021-31875 CRITICAL POC

9.8

CVE-2020-8443 CRITICAL POC

9.8

CVE-2019-14532 CRITICAL POC

9.8

CVE-2019-13306 HIGH POC

7.8

CVE-2019-13305 HIGH POC

7.8

CVE-2021-23017 HIGH POC

7.7

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2017-11882 HIGH POC

7.8

CVE-2010-3333 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/base-os-container:latest Container suse/sl-micro/6.0/kvm-os-container:latest Container suse/sl-micro/6.0/rt-os-container:latest	Affected
SUSE Enterprise Storage 7.1	Fixed
SUSE Liberty Linux 8	Fixed
SUSE Liberty Linux 9	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed

CVE-2025-54349 vulnerability details – vuln.today

Back

SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7	Fixed
SUSE Linux Enterprise Server 16.0	Fixed
SUSE Linux Enterprise Server 16.1	Fixed
SUSE Linux Enterprise Server for SAP applications 16.0	Fixed
SUSE Linux Enterprise Server for SAP applications 16.1	Fixed
openSUSE Leap 15.6	Fixed
SUSE Enterprise Storage 6	Fixed
SUSE Enterprise Storage 7	Fixed
SUSE Enterprise Storage 7.1	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP4	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.3	Fixed
openSUSE Leap 15.4	Fixed
openSUSE Leap 15.5	Fixed
SUSE Linux Micro Extras 6.0	Fixed
SUSE Linux Micro Extras 6.1	Fixed
SUSE Linux Micro Extras 6.2	Fixed

Iperf3 CVE-2025-54349

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Iperf3

Same weakness CWE-193 – Off-by-one Error

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code