« Volver al listado

CVE-2025-46802

Estado: AplazadaMedia (5.3)—

For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-46802",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46802",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-05-27T14:11:32.619124Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 0.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Micro 5.3",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Micro 5.4",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Micro 5.5",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Module for Basesystem 15 SP6",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Server 15 SP6",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Desktop 15 SP6",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise Server for SAP Applications 15 SP6",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "SUSE",
          "product": "SUSE Linux Enterprise High Performance Computing 15 SP6",
          "versions": [
            {
              "status": "affected",
              "version": "?",
              "lessThan": "4.6.2-150000.5.8.1",
              "versionType": "custom"
            }
          ],
          "packageName": "screen",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-05-26T16:15:20.557",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-46802",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2025/05/12/1",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://www.openwall.com/lists/oss-security/2025/05/12/1",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session."
    },
    {
      "lang": "es",
      "value": "Durante un breve período de tiempo, el PTY se establece en modo 666, lo que permite que cualquier usuario del sistema se conecte a la sesión de pantalla. "
    }
  ],
  "lastModified": "2026-06-17T09:26:57.400",
  "sourceIdentifier": "meissner@suse.de"
}