tftpsync CVE-2025-53880

Exploitation requires network reachability to the tftpsync/add or tftpsync/delete scripts, which are exposed only to an adjacent network (AV:A) AND restricted to an explicit allow-list of IP addresses - so the attacker must originate from, spoof, or compromise a host on an allow-listed adjacent address. No authentication is required once that network position is held (PR:N, UI:N). The practical limiting factors are therefore the adjacent-network requirement and the IP allow-list, both of which substantially narrow the realistic attacker population below what the 8.7 score alone suggests; impact is bounded by the unprivileged wwwrun account rather than root.

This is a credible, moderately high-priority issue but not a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N) with a base score of 8.7 indicates low-complexity, unauthenticated exploitation yielding high confidentiality, integrity, and availability impact (VC:H/VI:H/VA:H). The decisive mitigating signal, however, is AV:A (Adjacent) rather than AV:N (Network): the vulnerable tftpsync/add and tftpsync/delete endpoints are reachable only from an adjacent network segment, and the description further notes access is restricted to an allow-list of IP addresses - so despite the endpoint being unauthenticated (PR:N), an attacker must already have a foothold on a trusted adjacent host or spoof/occupy an allow-listed address. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so there is no evidence of active or widespread exploitation; this currently reads as a high-impact-but-exposure-limited flaw rather than a mass-exploitation threat. Note a signal to verify: the CVSS 4.0 vector asserts VC:H (high confidentiality impact), yet the description only describes file write and delete as the unprivileged wwwrun user, which maps more naturally to integrity and availability - confidentiality impact is likely inferred from the possibility of chaining a file write into code execution/web shell. Verify the confidentiality claim with SUSE.

An attacker positioned on an adjacent network segment (or operating from an allow-listed IP) sends a crafted request to the unauthenticated tftpsync/add or tftpsync/delete script containing directory-traversal sequences in a path parameter, causing a file to be written or deleted outside the intended TFTP directory with wwwrun privileges. By writing a malicious file into a web-served or executable location, the attacker can escalate the arbitrary file write into remote code execution as wwwrun. No public exploit code is identified in the available data.