| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.5 | $0-$5k | 0.00 |
Summary
A vulnerability marked as critical has been reported in SUSE openSUSE Tumbleweed. Affected by this vulnerability is an unknown functionality of the component cyrus-imapd. This manipulation causes symlink. This vulnerability is handled as CVE-2025-23394. It is possible to launch the attack on the local host. There is not any exploit available. It is suggested to upgrade the affected component.
Details
A vulnerability classified as critical was found in SUSE openSUSE Tumbleweed. Affected by this vulnerability is an unknown code of the component cyrus-imapd. The manipulation with an unknown input leads to a symlink vulnerability. The CWE definition for the vulnerability is CWE-61. The product, when opening a file or directory, does not sufficiently account for when the file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to cause the product to operate on unauthorized files. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:
A UNIX Symbolic Link (Symlink) Following vulnerability in openSUSE Tumbleweed cyrus-imapd allows escalation from cyrus to root.This issue affects openSUSE Tumbleweed cyrus-imapd before 3.8.4-2.1.
The advisory is shared at bugzilla.suse.com. This vulnerability is known as CVE-2025-23394 since 01/15/2025. The exploitation appears to be easy. An attack has to be approached locally. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 06/18/2026).
The vulnerability scanner Nessus provides a plugin with the ID 321430 (openSUSE 16 Security Update : cyrus-imapd (openSUSE-SU-2026:20962-1)), which helps to determine the existence of the flaw in a target environment.
Upgrading to version 3.8.4-2.1 eliminates this vulnerability.
The vulnerability is also documented in the vulnerability database at Tenable (321430). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Vendor
Name
Version
License
Website
- Vendor: https://www.suse.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.8VulDB Meta Temp Score: 7.5
VulDB Base Score: 7.8
VulDB Temp Score: 7.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: SymlinkCWE: CWE-61 / CWE-59
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 321430
Nessus Name: openSUSE 16 Security Update : cyrus-imapd (openSUSE-SU-2026:20962-1)
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: UpgradeStatus: 🔍
0-Day Time: 🔍
Upgrade: openSUSE Tumbleweed 3.8.4-2.1
Timeline
01/15/2025 🔍05/26/2025 🔍
05/26/2025 🔍
06/18/2026 🔍
Sources
Vendor: suse.comAdvisory: bugzilla.suse.com
Status: Confirmed
CVE: CVE-2025-23394 (🔍)
GCVE (CVE): GCVE-0-2025-23394
GCVE (VulDB): GCVE-100-310321
Entry
Created: 05/26/2025 19:57Updated: 06/18/2026 12:39
Changes: 05/26/2025 19:57 (55), 06/18/2026 12:39 (2)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.