CVE-2025-62877

Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62877
https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv

Configurations

No configuration.

History

30 Sep 2026, 22:10

Type	Values Removed	Values Added
Summary		(es) Proyectos que utilizan el entorno de virtualización de SUSE (Harvester) pueden exponer la contraseña de inicio de sesión SSH predeterminada del sistema operativo si están utilizando el instalador interactivo 1.5.x o 1.6.x para crear un nuevo clúster o añadir nuevos hosts a un clúster existente. El entorno no se ve afectado si se utiliza el mecanismo de arranque PXE junto con la configuración de Harvester.

Information

Published : 2026-01-08 13:15

Updated : 2026-10-07 09:10

NVD link : CVE-2025-62877

Mitre link : CVE-2025-62877

CVE.ORG link : CVE-2025-62877

JSON object : View

Products Affected

No product.

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2025-62877", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-62877", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-08T14:40:02.987768Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"vendor": "SUSE", "product": "harvester", "versions": [{"status": "affected", "version": "1.6.0", "versionType": "semver"}, {"status": "affected", "version": "1.5.0", "versionType": "semver"}], "packageName": "github.com/harvester/harvester-installer", "defaultStatus": "unaffected"}]}], "published": "2026-01-08T13:15:41.923", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62877", "source": "meissner@suse.de"}, {"url": "https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv", "source": "meissner@suse.de"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Projects using the SUSE Virtualization (Harvester) environment may\u00a0expose the OS default ssh login password\u00a0\u00a0if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration\u00a0setup."}, {"lang": "es", "value": "Proyectos que utilizan el entorno de virtualizaci\u00f3n de SUSE (Harvester) pueden exponer la contrase\u00f1a de inicio de sesi\u00f3n SSH predeterminada del sistema operativo si est\u00e1n utilizando el instalador interactivo 1.5.x o 1.6.x para crear un nuevo cl\u00faster o a\u00f1adir nuevos hosts a un cl\u00faster existente. El entorno no se ve afectado si se utiliza el mecanismo de arranque PXE junto con la configuraci\u00f3n de Harvester."}], "lastModified": "2026-10-07T09:10:00.160", "sourceIdentifier": "meissner@suse.de"}