PT-2025-11659 · Smartos+1 · Smartos+1

Published 2025-03-19 · Updated 2025-03-24 · CVE-2025-30234

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SmartOS version 60f76fd2-143f-4f57-819b-1ae32684e81b

Description The issue concerns static host SSH keys in a specific Debian 12 LX zone image. This could potentially allow unauthorized access. The estimated number of affected devices is not provided. There is no information about real-world incidents where this issue was exploited. Technical details include the use of hard-coded cryptographic keys, specifically CWE-321 Use of Hard-coded Cryptographic Key.

Recommendations For SmartOS version 60f76fd2-143f-4f57-819b-1ae32684e81b, consider regenerating SSH keys to prevent unauthorized access. As a temporary workaround, restrict access to the affected image until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-30234

Affected Products

Debian

Smartos

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-30234 · Security Note
• https://twitter.com/CVEnew/status/1902219451195666598 · Twitter Post
• https://smartos.topicbox.com/groups/smartos-discuss/Ta6f13072e6bedddc-M3702e993edd7d6ce8d78dfc8 · Note
• https://openwall.com/lists/oss-security/2025/03/13/10 · Note
• https://t.me/cvenotify/115293 · Telegram Post
• https://t.me/latest_high_impact_cve/1997 · Telegram Post
• https://t.me/cvetracker/19418 · Telegram Post
• https://twitter.com/cracbot/status/1904126118409757166 · Twitter Post
• https://security.tritondatacenter.com/tps-2025-002 · Note
• https://t.me/cvedetector/20625 · Telegram Post