CVE-2025-14551

In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/canonical/subiquity/pull/2357	Issue Tracking Patch
https://github.com/canonical/subiquity/pull/2358	Issue Tracking Patch

Configurations

Configuration 1 (hide)

cpe:2.3:a:canonical:ubuntu_subiquity:24.04.4:*:*:*:*:*:*:*

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) En Ubuntu, Subiquity versión 24.04.4 podría filtrar credenciales de usuario sensibles durante el informe de fallos. Tras un fallo de instalación, si un usuario enviaba un informe de error a Launchpad, Subiquity podría incluir ciertas credenciales de usuario, como la contraseña de Wi-Fi del usuario en texto plano, en los registros adjuntos.

Information

Published : 2026-04-09 16:16

Updated : 2026-10-07 09:10

NVD link : CVE-2025-14551

Mitre link : CVE-2025-14551

CVE.ORG link : CVE-2025-14551

JSON object : View

Products Affected

canonical

ubuntu_subiquity

CWE

CWE-1258

Exposure of Sensitive System Information Due to Uncleared Debug Information

{"id": "CVE-2025-14551", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14551", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-10T13:53:25.206297Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security@ubuntu.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "UNREPORTED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@ubuntu.com", "affectedData": [{"repo": "https://github.com/canonical/subiquity", "vendor": "Canonical", "product": "Ubuntu", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "24.04.4"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "25.10"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "25.04"}], "platforms": ["Linux"], "packageName": "subiquity", "collectionURL": "https://github.com/canonical", "defaultStatus": "unaffected"}]}], "published": "2026-04-09T16:16:23.890", "references": [{"url": "https://github.com/canonical/subiquity/pull/2357", "tags": ["Issue Tracking", "Patch"], "source": "security@ubuntu.com"}, {"url": "https://github.com/canonical/subiquity/pull/2358", "tags": ["Issue Tracking", "Patch"], "source": "security@ubuntu.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@ubuntu.com", "description": [{"lang": "en", "value": "CWE-1258"}]}], "descriptions": [{"lang": "en", "value": "In Ubuntu, Subiquity version 24.04.4 could leak sensitive user credentials during crash reporting. Upon installation failure, if a user submitted a bug report to Launchpad, Subiquity could include certain user credentials, such as the user's plaintext Wi-Fi password, in the attached logs."}, {"lang": "es", "value": "En Ubuntu, Subiquity versi\u00f3n 24.04.4 podr\u00eda filtrar credenciales de usuario sensibles durante el informe de fallos. Tras un fallo de instalaci\u00f3n, si un usuario enviaba un informe de error a Launchpad, Subiquity podr\u00eda incluir ciertas credenciales de usuario, como la contrase\u00f1a de Wi-Fi del usuario en texto plano, en los registros adjuntos."}], "lastModified": "2026-10-07T09:10:00.160", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:canonical:ubuntu_subiquity:24.04.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CFFCFD89-EF20-4207-A3B1-0F3F368F0C69"}], "operator": "OR"}]}], "sourceIdentifier": "security@ubuntu.com"}