Oracle Solaris 11 Filesystem Local Privilege Escalation

Summaryinfo

A vulnerability labeled as critical has been found in Oracle Solaris 11. The impacted element is an unknown function of the component Filesystem. Such manipulation leads to Local Privilege Escalation. This vulnerability is documented as CVE-2025-30690. The attack needs to be performed locally. There is not any exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Oracle Solaris 11 and classified as critical. Affected by this issue is an unknown part of the component Filesystem. The manipulation with an unknown input leads to a local privilege escalation vulnerability. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle Solaris. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H).

The advisory is shared for download at oracle.com. This vulnerability is handled as CVE-2025-30690 since 03/25/2025. The exploitation is known to be difficult. The attack needs to be approached locally. The exploitation needs additional levels of successful authentication. Successful exploitation requires user interaction by the victim. There are neither technical details nor an exploit publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 234556 (Oracle Solaris Critical Patch Update : apr2025_SRU11_4_78_189_2), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (234556). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Oracle

Name

• Solaris

Version

• 11

License

• commercial

Website

• Vendor: https://www.oracle.com

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion