CVE-2025-54288CWE-290

CVE-2025-54288

Medium · published October 2, 2025

CVSS v3.1

6.8

EPSS

Percentile

27.3

In the wild

Unconfirmed

What it is

Information Spoofing in devLXD Server in Canonical LXD versions 4.0 and above on Linux container platforms allows attackers with root privileges within any container to impersonate other containers and obtain their metadata, configuration, and device information via spoofed process names in the command line.

The record

Technical detail

CVSS v3.1: 6.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00350 · 27.3th percentile
Weakness: CWE-290 · Authentication Bypass by Spoofing
Published: 2025-10-02T14:15Z

Affected products (2)

Product	Versions	Fixed in
canonical/lxd	≥ 4.0.0, < 5.21.4	5.21.4
canonical/lxd	≥ 6.1, < 6.5	6.5

References (2)

https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525 · [email protected]https://github.com/canonical/lxd/security/advisories/GHSA-7232-97c6-j525 · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

02 OCT 09:20Z
Source Container Identification Vulnerability via cmdline Spoofing in devLXD Server
cvelistv5