CVE-2025-32463
highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.555 · 99 %ileexploit · functionalDEEURUUSadded 2025-09-29remediate by 2025-10-20
required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
EPSS · scored 2026-10-24
Sudo Inclusion of Functionality from Untrusted Control Sphere Vulnerability
Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot option.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedSICK SID121 LFT with Firmware < 4.2.7sick_psirt
It is strongly recommended to upgrade to the latest version (4.2.7)
- FixedSICK SID121 with Firmware < 4.2.7sick_psirt
It is strongly recommended to upgrade to the latest version (4.2.7)
- FixedSICK SID71 LFT with Firmware < 4.2.7sick_psirt
It is strongly recommended to upgrade to the latest version (4.2.7)
- FixedSICK SID71 with Firmware < 4.2.7sick_psirt
It is strongly recommended to upgrade to the latest version (4.2.7)
- FixedEndress+Hauser MCS200HW with firmware <1.11.5.6Rsick_psirt
The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.
- Fixedwago_psirt
Update to Firmware version 04.08.01 (FW30) or higher.
- FixedEndress+Hauser MCS200HW with firmware <1.11.5.6Rendress_hauser_psirt
The display unit's firmware versions below 4.3.4 are affected. To address the vulnerability, customers are strongly recommended to update the display unit of their devices to firmware version 4.3.4. Endress+Hauser will include this firmware version in the MCS200HW products starting with version 1.11.5.6R. Alternatively, customers can contact Endress+Hauser directly to obtain the updated display firmware, or download the original firmware - including update instructions - from the Phoenix Contact website referenced below.
- Mitigationwago_psirt
Until Firmware 30 is available the vulnerability can be mitigated by installing an ipk to update sudo to 1.9.17p1. The ipk is available through the WAGO download center.
https://downloadcenter.wago.com/wago/software/details/mckqrqwdtxpqe857kf8 - MitigationEndress+Hauser MCS200HW with firmware <1.11.5.6Rendress_hauser_psirt
As a temporary mitigation measure, both system and network access to the affected functionality should be strictly restricted. Access should be limited to authorized personnel only, and exposure to external or untrusted networks should be minimized or fully blocked until an update of the display firmware has been completed.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.8–9.3
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (71)
Public proof-of-concept and weaponised exploit code.
- exploit/linux/local/sudo_chroot_cve_2025_32463Sudo Chroot 1.9.17 Privilege Escalationfunctional · metasploit
- EDB-52352Sudo chroot 1.9.17 - Local Privilege EscalationPoC · exploit_db
- 0x3c4dfa1/CVE-2025-32463sudo --chroot exploitPoC · poc_in_github
- 0xAkarii/CVE-2025-324630xAkarii/CVE-2025-32463PoC · poc_in_github
- 0xBlackash/CVE-2025-32463CVE-2025-32463PoC · poc_in_github
affected products (96)
Products and version ranges known to be affected.
- IBM Power Hardware Management Consoleall versionscert_bundDEcpe:/a:ibm:hardware_management_console:-
advisories (5)
Vendor and ecosystem advisories describing this.
- SCA-2025-0012Sudo vulnerability affects SICK SID products2025-10-27csaf · sick_psirtDE
SICK SID products are affected by the sudo vulnerability CVE-2025-32463. SICK strongly recommends to update to the latest version to mitigate the risk.
- SCA-2026-0007Sudo vulnerability affects Endress+Hauser MCS200HW2026-04-21csaf · sick_psirtDE
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
- VDE-2025-082WAGO: Critical sudo Vulnerability in Multiple Products2025-09-08csaf · wago_psirtDE
A vulnerability in sudo allows a low privileged attacker to execute commands with root rights.
- VDE-2026-032Endress+Hauser: sudo vulnerability affects Endress+Hauser MCS200HW2026-04-21csaf · endress_hauser_psirtDE
The display unit of the Endress+Hauser MCS200HW is affected by a sudo chroot vulnerability.
- WID-SEC-W-2025-1428sudo: Mehrere SchwachstellenDeutsch2025-06-30csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen in sudo ausnutzen, um Sicherheitsvorkehrungen zu umgehen und seine Rechte auf "root" zu erweitern.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (41)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2025-32463cnnvd
- https://cxsecurity.com/issue/WLB-2025070037cnnvd
- https://vigilance.fr/vulnerability/Sudo-privilege-escalation-via-chroot-47568cnnvd
- https://www.exploit-db.com/exploits/52352cnnvd
- https://www.openwall.com/lists/oss-security/2025/06/30/3cnnvd
- https://www.stratascale.com/vulnerability-alert-CVE-2025-32463-sudo-chrootcnnvd
- https://www.sudo.ws/Patchcnnvd
- https://www.sudo.ws/releases/changelog/cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan