Vulnerability details
CVE-2025-62877
SUSE Harvester
Harvest may expose OS default ssh login password via SUSE Virtualization Interactive Installer
CVSS 3.1
9.8Critical
Official description
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (suse) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SUSE | Harvester | 1.5.0 | CVEProject cvelistV5 (CNA) |
| SUSE | Harvester | 1.6.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-01-08
- Last updated
- 2026-01-08
- State
- Published
- Assigner (CNA)
- suse
Exploit prediction (EPSS)
0.51%
Probability of exploitation in 30 days
44%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-1188Initialization of a Resource with an Insecure Default