CVE-2025-10622

HIGH LAB

Red Hat Satellite - Command Injection

Title source: llm

Description

A flaw was found in Red Hat Satellite (Foreman component). This vulnerability allows an authenticated user with edit_settings permissions to achieve arbitrary command execution on the underlying operating system via insufficient server-side validation of command whitelisting.

Exploits (1)

github WORKING POC
by exploitintel · pythonpoc
https://github.com/exploitintel/eip-pocs-and-cves/tree/main/CVE-2025-10622

References (7)

Related Analysis

Scores

CVSS v3 8.0
EPSS 0.0008
EPSS Percentile 23.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Lab Environment

EIP LAB Lab screenshot
vulnerable docker pull ghcr.io/exploitintel/cve-2025-10622-vulnerable:latest
COMMUNITY
docker pull postgres:12
docker pull redis:7

Details

CWE
CWE-78
Status published
Products (7)
Red Hat/Red Hat Satellite 6
Red Hat/Red Hat Satellite 6.15 for RHEL 8 0:3.9.1.13-1.el8sat
Red Hat/Red Hat Satellite 6.16 for RHEL 8 0:3.12.0.11-1.el8sat
Red Hat/Red Hat Satellite 6.16 for RHEL 9 0:3.12.0.11-1.el9sat
Red Hat/Red Hat Satellite 6.17 for RHEL 9 0:3.14.0.10-1.el9sat
Red Hat/Red Hat Satellite 6.18 for RHEL 9 0:3.16.0.4-1.el9sat
The Foreman/Foreman 3.12.0 - 3.16.1
Published Nov 05, 2025
Tracked Since Feb 18, 2026