Overview
In the ever-evolving landscape of cybersecurity, a new vulnerability has emerged that holds significant implications for systems running SUSE Manager. Identified as CVE-2025-46811, this vulnerability exposes a critical loophole in authentication for crucial system functions. It allows an attacker with access to a specific websocket to execute arbitrary commands as the root user, potentially compromising sensitive data or the entire system.
This vulnerability is particularly alarming due to its potential wide reach and the severity of its implications. It affects various versions of SUSE Manager, including several container and image versions. Therefore, it is crucial for organizations running these systems to understand the vulnerability and take immediate action to mitigate their risk.
Vulnerability Summary
CVE ID: CVE-2025-46811
Severity: Critical, CVSS Score of 9.8
Attack Vector: Network
Privileges Required: None
User Interaction: None
Impact: Potential system compromise or data leakage
Affected Products
Escape the Surveillance Era
Most apps won’t tell you the truth.
They’re part of the problem.
Phone numbers. Emails. Profiles. Logs.
It’s all fuel for surveillance.
Ameeba Chat gives you a way out.
- • No phone number
- • No email
- • No personal info
- • Anonymous aliases
- • End-to-end encrypted
Chat without a trace.
Product | Affected Versions
SUSE Manager | Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: before 0.3.7-150600.3.6.2
SUSE Manager | Container suse/manager/5.0/x86_64/server:5.0.5.7.30.1: before 5.0.14-150600.4.17.1
SUSE Manager | Image SLES15-SP4-Manager-Server-4-3-BYOS: before 4.3.33-150400.3.55.2
SUSE Manager | Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: before 4.3.33-150400.3.55.2
SUSE Manager | Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: before 4.3.33-150400.3.55.2
SUSE Manager | Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: before 4.3.33-150400.3.55.2
SUSE Manager Server Module | 4.3: before 0.3.7-150400.3.39.4
SUSE Manager Server Module | 4.3: before 4.3.33-150400.3.55.2
How the Exploit Works
The CVE-2025-46811 vulnerability lies within SUSE Manager’s authentication process for critical functions. An attacker who has network access to the websocket located at /rhn/websocket/minion/remote-commands can bypass the authentication and execute arbitrary commands as the root user. This exploit allows the attacker to potentially seize control of the system or access sensitive data.
Conceptual Example Code
Below is a conceptual example of how this vulnerability could be exploited:
# Connect to the websocket
websocket_client -H target.example.com/rhn/websocket/minion/remote-commands
# Once connected, execute arbitrary command as root
{
"command": "rm -rf /",
"parameters": ["--no-preserve-root"]
}Please note that the above code is a theoretical example and should not be executed as it will cause irreparable damage to your filesystem. It is provided for educational purposes only to highlight the severity of the vulnerability.