Red Hat Web Terminal EUVD-2025-209302

The CVSS 6.4 score reflects the narrow attack preconditions: local access (AV:L), high complexity (AC:H), and high privileges required (PR:H). However, these constraints are somewhat misleading in a container context. The PR:H indicates the attacker must already be a high-privilege user (root group member), but in shared or multi-tenant container environments, non-root container processes are commonplace and may indeed possess root group membership through POSIX group assignments. The AC:H (high complexity) suggests exploitation requires unusual conditions, but modification of /etc/passwd via group membership is straightforward once those preconditions exist. The EPSS score is not provided in the input, limiting probability assessment. CISA KEV status is not confirmed, and no public proof-of-concept is reported, indicating this is not yet confirmed as actively exploited or widely weaponized. The real-world risk depends heavily on deployment context: container environments with multi-user access, CI/CD pipelines, or shared container images face higher risk. In single-user or well-isolated container scenarios, risk is lower. The vulnerability is primarily relevant to container security postures rather than traditional host-based security.

A non-root application process running within a Red Hat Web Terminal container that is a member of the root group (GID 0) could execute a simple command sequence to append a new root-privileged user entry to /etc/passwd. For example, using 'echo hacker:x:0:0::/root:/bin/sh >> /etc/passwd' followed by 'su hacker' would grant the attacker root shell access within the container, enabling complete compromise of the containerized application and access to any secrets or data mounted therein. No public exploit code is currently known, but the attack is trivial to execute once the group membership prerequisite is met.