CVE-2025-46811: SUSE Multi Linux Manager allows code execution via unprotected websocket endpoint
A Missing Authorization vulnerability in SUSE Linux Manager allows anyone with the ability to connect to port 443 of SUSE Manager is able to run any command as root on any client. This issue affects Container suse/manager/5.0/x8664/server:5.0.5.7.30.1: from ? before 5.0.27-150600.3.33.1; Image SLES15-SP4-Manager-Server-4-3-BYOS: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-EC2: from ? before 4.3.87-150400.3.110.2; Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE: from ? before 4.3.87-150400.3.110.2; SUSE Manager Server Module 4.3: from ? before 4.3.87-150400.3.110.2.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-46811?
CVE-2025-46811 is categorized as a critical vulnerability due to its potential for arbitrary command execution as root.
How do I fix CVE-2025-46811?
To remediate CVE-2025-46811, users should update SUSE Manager to a version that includes the security patch.
Which versions are affected by CVE-2025-46811?
CVE-2025-46811 affects SUSE Manager versions below 0.3.7-150600.3.6.2 and from 5.0.14-150600.4.17.1.
What are the impacts of CVE-2025-46811?
The impact of CVE-2025-46811 allows unauthorized users to execute arbitrary commands on the server, leading to potential system compromise.
Who is at risk from CVE-2025-46811?
Any organization using the affected versions of SUSE Manager is at risk if the websocket endpoint is accessible.