CVE-2025-10650lowCWE-269

CVE-2025-10650: falha de baixa gravidade em SoftIron HyperCloud

Improper SSH Key Handling in Internal Debug Builds May Grant Cluster-Level Access to Non-Administrative Users

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar HyperCloud

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 1.8epss 0.1%
SoftIron HyperCloud 2.5.0 through 2.6.3 may incorrectly add user SSH keys to the administrator-level authorized keys under certain conditions, allowing unauthorized privilege escalation to admin via SSH. Affects non-production debug and internal development builds created between versions 2.5.0 and 2.6.3.  No generally available (GA) or customer-released production builds were affected.  There is no evidence that this issue was exposed in customer environments or production deployments.
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Produtos afetados
SoftIron · HyperCloud
CVEs relacionadas — SoftIron HyperCloud

No mesmo produto, das mais perigosas para as menos.

CVE-2026-116755HIGHSoftIron HyperCloud: OS Command Injection in Orchestrator via Virtual Machine Template FieldsEPSS 0.9%CVE-2024-13058MEDIUMAuthenticated, non-admin users can create storage pools via the sifi APIEPSS 0.4%CVE-2026-1842MEDIUMHyperCloud Improper Refresh Token Validation and Access Token Invalidation Allows Long-Term Unauthorized AccessEPSS 0.2%CVE-2023-45083MEDIUMHyperCloud: "admin" and "serveradmin" users can be deletedEPSS 0.2%CVE-2023-45084HIGHMedia caddy removal and reinsertion without reboot may cause data lossEPSS 0.2%CVE-2023-45085LOWWhen compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"EPSS 0.2%