Critical SUSE Manager Vulnerability Allows Remote Root Command Execution

A severe security vulnerability has been discovered in SUSE Manager that allows unauthenticated attackers to execute arbitrary commands with root privileges through an exposed websocket endpoint.

The vulnerability, tracked as CVE-2025-46811, has been assigned a critical CVSS score of 9.3 and affects multiple versions of SUSE Manager across various deployment configurations including containers and cloud images.

The vulnerability stems from a missing authentication mechanism for a critical websocket function located at /rhn/websocket/minion/remote-commands.

This security vulnerability allows any user with network access to the websocket endpoint to execute arbitrary commands with root privileges, representing one of the most severe types of security vulnerabilities possible in enterprise systems.

The technical classification of this vulnerability falls under CWE-306 (Missing Authentication for Critical Function), indicating that the affected system fails to properly verify user identity before granting access to sensitive operations.

The CVSS 4.0 vector string reveals several concerning aspects: the vulnerability can be exploited over the network with low attack complexity, requires no privileges or user interaction, and results in high impact to confidentiality, integrity, and availability of the vulnerable system.

This type of vulnerability is particularly dangerous because it provides attackers with immediate root-level access without requiring any form of credential compromise or privilege escalation.

The websocket interface, typically used for real-time communication between SUSE Manager and managed systems, becomes a direct pathway for malicious actors to gain complete control over the management infrastructure.

SUSE Manager Vulnerability

The vulnerability impacts a wide range of SUSE Manager deployments across different versions and deployment models.

SUSE Manager Server Module 4.3 installations are affected, with fixes requiring updates to version 4.3.33-150400.3.55.2 or later.

The vulnerability also affects specific container images, including suse/manager/5.0/x86_64/server:5.0.5.7.30.1, which require updates to versions 0.3.7-150600.3.6.2 and 5.0.14-150600.4.17.1.

Cloud-based deployments are equally vulnerable, with multiple SLES15-SP4-Manager-Server-4-3-BYOS images affected across major cloud platforms.

This includes deployments on Amazon EC2, Microsoft Azure, and Google Cloud Platform, all requiring updates to version 4.3.33-150400.3.55.2 or later.

The broad scope of affected systems indicates that organizations using SUSE Manager in various deployment configurations need to prioritize patching efforts across their entire infrastructure.

The vulnerability’s presence across both on-premises and cloud deployments suggests that the underlying code defect exists in the core SUSE Manager codebase, making it a systemic issue rather than a configuration-specific problem.

This widespread impact amplifies the urgency for organizations to assess their current deployments and implement necessary security updates.

Security Implications

The critical nature of this vulnerability demands immediate attention from organizations running SUSE Manager infrastructure.

CVE-2025-46811 represents a significant security risk that requires immediate remediation across all affected SUSE Manager deployments.

With no authentication required and the ability to execute commands as root, attackers could potentially compromise entire managed environments, access sensitive data, install malware, or use compromised systems as launching points for further attacks within the network.

Organizations should immediately audit their SUSE Manager deployments to identify vulnerable versions and prioritize emergency patching.

Network security controls such as restricting access to the websocket endpoint through firewalls or access control lists can provide temporary mitigation while patches are being applied.

However, these measures should be considered temporary solutions rather than permanent fixes.

The combination of network accessibility, lack of authentication requirements, and root-level command execution capabilities makes this vulnerability extremely attractive to malicious actors.

Organizations must treat this as a critical security incident, implementing patches as soon as possible while monitoring for any signs of exploitation in their environments.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.