Rt Thread CVE-2025-5869

The CVSS 3.1 score of 8.0 with vector CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H indicates high severity with important constraints: (1) AV:A (Adjacent Network) means local/network-adjacent access only—not remotely exploitable from the internet; (2) PR:L (Low Privilege) requires an authenticated local account or process; (3) AC:L indicates low complexity, making exploitation straightforward once access is obtained; (4) High impact across all three CIA triad factors (Confidentiality, Integrity, Availability) demonstrates complete system compromise potential. The EPSS score (if available) would likely be elevated given the straightforward exploitation path for local attackers. This represents a genuine high-priority vulnerability for deployed RT-Thread systems, particularly in IoT/embedded environments where local network access may be common. However, the requirement for local authentication significantly reduces Internet-facing attack surface compared to unauthenticated remote vulnerabilities. KEV active exploitation status and POC availability are critical signals—if this is being actively exploited in the wild, priority escalates substantially.

An attacker with a valid local user account or low-privilege process on an RT-Thread-based embedded device (e.g., industrial controller, smart home gateway) crafts a malicious recvfrom syscall with a specially formed 'from' address parameter pointing to an attacker-controlled buffer or kernel memory address. The unvalidated parameter causes the kernel to write network socket metadata (source address, port) beyond the intended buffer boundary, overwriting adjacent kernel structures such as function pointers, capability bits, or process control blocks. With careful alignment and multiple syscall invocations, the attacker achieves arbitrary kernel code execution, allowing privilege escalation to root equivalent, installation of persistent backdoors, or system DoS. The low complexity (AC:L) means standard fuzzing or parameter enumeration techniques would quickly identify the overflow condition. If a public POC exists, exploitation becomes trivial for any attacker with local system access.