Threat Advisory

Unauthenticated Remote Command Execution Vulnerability in SUSE Manager

Threat: Vulnerability
Targeted Region: Global
Targeted Sector: Technology & IT
Criticality: Critical
[subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A major security vulnerability has been identified in SUSE Manager that allows attackers on the same network to execute commands remotely with full root access, without needing to log in. The vulnerability is extremely easy to exploit and requires no user interaction, making it a high risk for enterprise systems. It arises from an authentication failure in a WebSocket component used for remote commands. Due to its critical nature and the potential for system-wide compromise, the vulnerability has been assigned a CVSS v4.0 score of 9.3.[/subscribe_to_unlock_form]

EXECUTIVE SUMMARY:

A major security vulnerability has been identified in SUSE Manager that allows attackers on the same network to execute commands remotely with full root access, without needing to log in. The vulnerability is extremely easy to exploit and requires no user interaction, making it a high risk for enterprise systems. It arises from an authentication failure in a WebSocket component used for remote commands. Due to its critical nature and the potential for system-wide compromise, the vulnerability has been assigned a CVSS v4.0 score of 9.3.[emaillocker id="1283"]

  • CVE-2025-46811: This vulnerability exists due to missing authentication on a critical WebSocket endpoint located at /rhn/websocket/minion/remote-commands. Any user on the network can exploit this flaw to send remote commands to the SUSE Manager server, gaining root-level control. No special privileges or credentials are needed, and no user interaction is required, making it highly dangerous. The issue affects multiple container and cloud versions of SUSE Manager, including Azure, EC2, and GCE images.

This vulnerability in SUSE Manager allows remote attackers to gain full control of affected systems without any credentials. Due to its severe impact and ease of exploitation, it should be treated as a top-priority threat.
RECOMMENDATION:

We strongly recommend you update SUSE Manager systems to versions 0.3.7-150600.3.6.2, 5.0.14-150600.4.17.1, 4.3.33-150400.3.55.2, or 0.3.7-150400.3.39.4.

REFERENCES:

The following reports contain further technical details:
https://cybersecuritynews.com/suse-manager-vulnerability/

[/emaillocker]
crossmenu