CVE-2025-46802

MediumCVSS 6.0/10Last modified Jun 17, 2026

Description

For a short time they PTY is set to mode 666, allowing any user on the system to connect to the screen session.

Metrics

CVSS 3.1 6.0/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-732

Affected software

VendorProductVersions
SUSESUSE Linux Enterprise Micro 5.3>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Micro 5.4>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Micro 5.5>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Module for Basesystem 15 SP6>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Server 15 SP6>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Desktop 15 SP6>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise Server for SAP Applications 15 SP6>= ?, < 4.6.2-150000.5.8.1
SUSESUSE Linux Enterprise High Performance Computing 15 SP6>= ?, < 4.6.2-150000.5.8.1

References

Timeline

Published
May 26, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-468035.0The default mode of pseudo terminals (PTYs) allocated by Screen was changed from 0620 to 0622, thereby allowing anyone to write to any ScreeCVE-2025-468043.3A minor information leak when running Screen with setuid-root privileges allows unprivileged users to deduce information about a path that wCVE-2025-468055.5Screen version 5.0.0 and older version 4 releases have a TOCTOU race potentially allowing to send SIGHUP, SIGCONT to privileged processes wCVE-2025-468066.9A Use of Out-of-range Pointer Offset vulnerability in sslh leads to denial of service on some architectures.This issue affects sslh before 2CVE-2025-468078.7A Allocation of Resources Without Limits or Throttling vulnerability in sslh allows attackers to easily exhaust the file descriptors in sslhCVE-2025-468086.8An Insertion of Sensitive Information into Log File vulnerability in SUSE neuvector manager exposes sensitive information into the manager cCVE-2025-468095.7A Plaintext Storage of a Password vulnerability in SUSE exposes the credentials for the HTTP proxy in the log files. This issue affects ContCVE-2025-46818.6Improper Privilege Management vulnerability in upKeeper Solutions upKeeper Instant Privilege Access allows Privilege Abuse.This issue affectCVE-2025-468108.5A UNIX Symbolic Link (Symlink) Following vulnerability in the packaging of openSUSE Tumbleweed traefik2 allows the traefik user to escalate CVE-2025-468119.8A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able toCVE-2025-468122.0Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Versions prior to 2.1.15 are vulnerable to XSS attacks when paCVE-2025-468137.5Discourse is an open-source community platform. A data leak vulnerability affects sites deployed between commits 10df7fdee060d44accdee7679d6