What is the CVSS score of CVE-2025-2515?

CVE-2025-2515 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of BlueChi are affected by CVE-2025-2515?

Eclipse BlueChi in Red Hat In-Vehicle Operating System (RHIVOS) contains a privilege escalation vulnerability (CVE-2025-2515, CVSS 7.2) that allows a compromised managed vehicle node to write…

How to fix or mitigate CVE-2025-2515?

24 hours: Audit deployed RHIVOS systems with BlueChi and identify all managed nodes with root-level access capabilities; determine whether cross-node service execution is required for business operations. 7 days: Implement network segmentation isolating managed quality-management (qm) nodes from controlling host nodes; disable cross-node proxy and dependency requests if not operationally required; restrict sudo/root access on managed nodes to minimal necessary accounts. 30 days: Monitor Red Hat security advisories for patch release; evaluate upgrade path to patched BlueChi version once available; conduct threat hunt for signs of exploitation via systemd unit file anomalies on host nodes.

BlueChi CVE-2025-2515

HIGH

Incorrect Authorization (CWE-863)

2025-12-24 secalert@redhat.com

Authentication Bypass Privilege Escalation

7.2

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

7.2 HIGH

AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Red Hat

7.2 HIGH

qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jun 25, 2026 - 03:31 vuln.today

Analysis Generated

Jun 25, 2026 - 03:31 vuln.today

DescriptionCVE.org

A vulnerability was found in BlueChi, a multi-node systemd service controller used in RHIVOS. This flaw allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node. This issue can lead to privilege escalation, unauthorized service execution, and potential system compromise.

AnalysisAI

Privilege escalation in Eclipse BlueChi, the multi-node systemd service controller used in Red Hat In-Vehicle Operating System (RHIVOS), allows a user holding root on a managed quality-managed (qm) node to write or override systemd service unit files that execute on the controlling host node. Because BlueChi did not deny cross-node proxy/dependency requests by default, a compromised lower-trust node could pivot to the host, leading to unauthorized service execution and full host compromise (CWE-863, Incorrect Authorization). Red Hat scored it 7.2 (High); there is no public exploit identified at time of analysis and it is not listed in CISA KEV.