Skip to main content

Suse CVE-2025-23394

CRITICAL
UNIX Symbolic Link (Symlink) Following (CWE-61)
2025-05-26 meissner@suse.de
Privilege Escalation Suse
9.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE
CRITICAL
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Patch released
Apr 05, 2026 - 08:30 nvd
Patch available
Analysis Generated
Mar 28, 2026 - 18:43 vuln.today
CVE Published
May 26, 2025 - 16:15 nvd
CRITICAL 9.8

DescriptionCVE.org

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.

AnalysisAI

A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.8.4-2.1. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-61. A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.8.4-2.1. Version information: before 3.8.4.

Affected ProductsAI

See vendor advisory for affected versions.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

Same weakness CWE-61 – UNIX Symbolic Link (Symlink) Following

View all
CVE-2026-54420 HIGH POC
8.5
CVE-2026-27976 HIGH POC
8.8
CVE-2024-22014 HIGH POC
8.8
CVE-2025-52565 HIGH POC
8.4
CVE-2026-41326 HIGH POC
8.2
CVE-2025-1079 HIGH POC
7.8
CVE-2021-25321 HIGH POC
7.8
CVE-2021-25322 HIGH POC
7.8

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-5689 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8
CVE-2016-10372 CRITICAL POC
9.8
CVE-2014-9583 CRITICAL POC
10.0
CVE-2012-0297 CRITICAL POC
10.0

Vendor StatusVendor

SUSE

Severity: Critical
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 11 SP2 Fixed
SUSE Linux Enterprise Desktop 11 SP3 Fixed
SUSE Linux Enterprise Desktop 11 SP4 Fixed
SUSE Linux Enterprise Point of Sale 11 SP3 Fixed

Share

CVE-2025-23394 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy