CVE-2025-49480 is a high severity (CVSS 7.4) memory safety flaw in ASR ASR180x and ASR190x cellular baseband software, in the file apps/lzma/src/LzmaEnc.c. The record says it affects Falcon_Linux, Kestrel and Lapwing_Linux before v1536. Ask your device or module vendor for firmware at v1536 or later.
What's affected
The record covers ASR180x and ASR190x baseband chips and lists ASR1803, ASR1806, ASR1901 and ASR1903. The affected software lines are Falcon_Linux, Kestrel and Lapwing_Linux, in every version before v1536, per the record. Out-of-bounds access (an out-of-bounds read, CWE-125) in the LZMA code of the lte-telephony component, tied to the file apps/lzma/src/LzmaEnc.c.
Most people do not install this software directly. It runs inside cellular modules and routers, IoT gateways and similar devices built by other companies. That means your exposure depends on whether a product you own contains one of these chips, and on whether its maker has taken the fix from ASR into a firmware release.
The vendor's security center lists this CVE in its bulletins with a High security rating. That page is the place to check for the current status. The CVSS vector in the record shows a network attack vector, low attack complexity and low privileges required, so some level of access to the affected service is needed first.
How to check if you're exposed
There is no package to query here. Work from your device inventory:
- List devices with a cellular modem, such as routers, trackers, meters and gateways.
- Find the modem chipset in the product datasheet or the vendor's support page. Look for ASR1803, ASR1806, ASR1901 or ASR1903.
- Find the modem firmware or software version in the device's status page or management console, and compare it with v1536.
If the vendor does not publish the underlying baseband version, ask them directly. A support answer that names the build is more reliable than guessing.
What to do now
- Build a list of devices that contain ASR baseband chips.
- Ask each device vendor whether their firmware includes ASR software at v1536 or later, and when an update ships.
- Apply vendor firmware updates as they arrive, testing on a small group of devices first.
- Where updates are not available, limit what the device can reach and what can reach it, for example with a private APN or network segmentation.
- Add the chipset to your asset records so the next bulletin is quick to match.
Why it matters
The weakness is CWE-125, a memory safety error where code reads or writes outside the buffer it was given. In baseband software that parses data from the cellular network or from local commands, a memory error can lead to crashes or, depending on the details, worse effects on the device.
Firmware like this is a supply chain problem more than a patching problem. The chip maker fixes the code, the module maker integrates it, the device maker ships it, and the owner installs it. Each hand off can take months. The record's KEV flag is false, so this CVE is not listed as exploited in the wild.
Quick check
Which versions does CVE-2025-49480 affect?
Per the record, Falcon_Linux, Kestrel and Lapwing_Linux before v1536 on ASR180x and ASR190x chips. Confirm with your device vendor which build you run.
Can I fix this myself?
Not usually. The fix comes through firmware from the device or module maker, so ask them for an update that includes ASR software at v1536 or later.
Sources
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan for the libraries in projects you manage.
Last reviewed: 18 October 2026.
