[0day-rubbish] Puppet Enterprise 2025.10.0 Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (8.8)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-04 00:11 UTC
Importiert: 2026-09-04 00:47 UTC
CVSS: 8.6
Quelle-ID: full_disc
uid_hash: 9eca031642f9a167066361d8d5647dda0ef3b420106536b13038b085f695fb25

Full Disclosure

Posted by disclosure via Fulldisclosure on Sep 03 0day Rubbish Research Team is publicly disclosing a vulnerability in Puppet Enterprise 2025.10.0.

Type: Authenticated command injection to root RCE (patch-bypass variant of CVE-2025-5459) (CWE-78)

CVSS: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Impact: Root command execution on the PE master, the control plane of the managed fleet: catalogs, certificates,

secrets, and orchestration under attacker control.

Authentication: authenticated...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2025-5459	HIGH	8.6	HIGH	8.6			2025-06-26

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss