EUVD-2025-209375
GHSA-5p47-92qw-3767
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Hardware debug access restrictions
|
| Impact | This vulnerability presents low real-world risk despite handling sensitive credentials. The CVSS 4.0 vector (score 2.7) indicates minimal confidentiality impact (VC:L) with network-based reporting-a controlled attack surface. EPSS exploitation probability is marked 'U' (unassigned/unavailable), suggesting no empirical exploitation data. The KEV (CISA Known Exploited Vulnerabilities) status is not present, indicating no confirmed active exploitation. Critically, the attack requires user action: the installation must fail, and the user must voluntarily submit a crash report to Launchpad rather than retaining logs locally. This user-interaction requirement (UI:N in vector notation indicates unauthenticated but not necessarily unattended; context-driven submission gates the actual risk). Compared to remote unauthenticated code execution or local privilege escalation scenarios, this is a passive credential exposure contingent on user behavior. The combination of low CVSS, no KEV status, optional user interaction in crash reporting, and vendor patch availability makes this a lower-priority vulnerability from an urgency standpoint, though it merits remediation due to credential exposure. |
| Exploit ScenarioDerived | An attacker does not directly exploit this vulnerability; instead, a user encountering an Ubuntu installation failure might unknowingly expose credentials by opting to submit an automatic crash report to Launchpad. If the diagnostic logs generated during the failed installation contain plaintext Wi-Fi passwords or other secrets, these are transmitted to Canonical's servers and potentially visible in the public or semi-public Launchpad bug database, depending on privacy settings. A third party monitoring Launchpad bug reports could harvest credentials from attached logs. This scenario requires the user to trigger an installation failure, select the crash-reporting option, and submit the report-all deliberate steps-which significantly constrains real-world exploitation compared to a remote code execution attack. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 09, 2026
Ubuntu Subiquity 24.04.4 leaks sensitive user credentials in crash report logs submitted to Launchpad during installation failures, potentially exposing plaintext Wi-Fi passwords and other credentials to unauthorized third parties. The vulnerability affects multiple Ubuntu versions (24.04.4, 25.04, and 25.10) and requires user interaction (submission of a crash report) but carries low real-world exploitation risk due to a CVSS score of 2.7 and absence of active exploitation signals. No public exploit code is known; vendor-released patches are available.
RemediationAI
Vendor-released patches are available via GitHub pull requests #2358 and #2357 in the canonical/subiquity repository. Users should update Subiquity to a patched version released after these PRs were merged; exact version numbers are not specified in available data, so users should reference Canonical's Ubuntu security advisories for the definitive patched release version for their Ubuntu variant (Desktop, Server, or Cloud Images). As an interim measure before patching, users experiencing installation failures should avoid submitting crash reports to Launchpad if they are concerned about credential exposure; instead, file manual bug reports without attaching diagnostic logs. Desktop and Server users can check for updates via standard package managers (apt-get update && apt-upgrade) once patches are released through Canonical repositories. For air-gapped or managed deployments, coordinate patching through configuration management tools or Ubuntu Pro subscriptions.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in pypi, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Subiquity is Ubuntu's server installation framework responsible for automated OS deployment and system configuration. The vulnerability stems from CWE-1258 (Exposure of Sensitive Information Through Query Strings or Log Files), where sensitive credentials-specifically plaintext Wi-Fi passwords and other user-provided secrets-are inadvertently included in diagnostic logs generated during installation failures. When a user opts to report a crash to Launchpad's bug-tracking system, these logs are attached and transmitted, exposing credentials to Canonical infrastructure and potentially to public bug reports. The root cause is insufficient credential sanitization in the log generation and packaging logic before submission.
Know when Canonical gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U
Primary rating from Vendor (canonical) · only source for this CVE.
CVSS VectorVendor: canonical
Lifecycle Timeline
2DescriptionCVE.org
In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Oracle Java SE JDK/JRE 7 and 6 Update 27 and earlier allows remote code execution with complete system compromise throug
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which
Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using
The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.
When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTT
Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packe
Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by lev
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and
Local privilege escalation in the GNU C Library (glibc) dynamic loader ld.so allows unprivileged local users on affected
Exploit-DB