CVE-2025-26701

Published Mar 11, 2025

Last updated 24 days ago

Percona

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-26701 is a security vulnerability found in Percona Monitoring and Management (PMM) Open Virtual Appliance (OVA) installations, specifically versions 2.38 and above, and before version 3.0.0-1. This vulnerability does not affect Docker or Amazon Machine Images (AMIs). The vulnerability stems from default service account credentials in the OVA provisioning, which can lead to unauthorized SSH access, privilege escalation to root via sudo capabilities, and potential exposure of service credentials and configurations. Successful exploitation could allow an attacker to gain unauthorized root access to database environments.

Description: An issue was discovered in Percona PMM Server (OVA) before 3.0.0-1.ova. The default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure. This is fixed in PMM2 2.42.0-1.ova, 2.43.0-1.ova, 2.43.1-1.ova, 2.43.2-1.ova, and 2.44.0-1.ova and in PMM3 3.0.0-1.ova and later.
Source: cve@mitre.org
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 10
Impact score: 6
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

cve@mitre.org: CWE-1393

Hype score: Not currently trending

Overview

AI description

Risk scores

CVSS 3.1

Weaknesses

Social media

References