PT-2025-53317 · Rhivos+2 · Rhivos+2

Thibault Guittet + 1 · Published 2025-12-24 · Updated 2025-12-24 · CVE-2025-2515

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:P/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BlueChi (affected versions not specified)

Description A flaw exists in BlueChi, a multi-node systemd service controller used in RHIVOS. A user possessing root privileges on a managed node (qm) can create or override systemd service unit files impacting the host node. This can result in privilege escalation, unauthorized service execution, and potential system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-2515

Affected Products

Bluechi

Rhivos

Systemd

References · 10

• https://osv.dev/vulnerability/CVE-2025-2515 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2515 · Security Note
• https://github.com/eclipse-bluechi/bluechi/issues/1069 · Note
• https://github.com/eclipse-bluechi/bluechi/pull/1073 · Note
• https://github.com/eclipse-bluechi/bluechi/commit/fe0d28301ce2bd45f0b1d8a98a94efef799fbc73#diff-64140c83db42a8888f346a40de293b80f79ebf7d75ce4137b22567e360bce607 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2353313 · Note
• https://twitter.com/CVEnew/status/2003932320265281557 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-2515 · Note
• https://t.me/CVEtracker/40615 · Telegram Post
• https://twitter.com/RedPacketSec/status/2003921737990258777 · Twitter Post