CVE-2025-1390: Anolis OS 2.73;0; +19 more affected products

Affected technology

Anolis OS · 2.73;0
OpenAnolis

RUGGEDCOM RST2428P · 0 to before V3.3
Siemens

SCALANCE XC-300/XR-300/XC-400/XR-500WG/XR-500 family · 0 to before V3.3
Siemens

SCALANCE XCH328 · 0 to before V3.3
Siemens

SCALANCE XCM324 · 0 to before V3.3
Siemens

SCALANCE XCM328 · 0 to before V3.3
Siemens

SCALANCE XCM332 · 0 to before V3.3
Siemens

SCALANCE XRH334 (24 V DC, 8xFO, CC) · 0 to before V3.3
Siemens

SCALANCE XRM334 (230 V AC, 12xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (230 V AC, 8xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (230V AC, 2x10G, 24xSFP, 8xSFP+) · 0 to before V3.3
Siemens

SCALANCE XRM334 (24 V DC, 12xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (24 V DC, 8xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (24V DC, 2x10G, 24xSFP, 8xSFP+) · 0 to before V3.3
Siemens

SCALANCE XRM334 (2x230 V AC, 12xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (2x230 V AC, 8xFO) · 0 to before V3.3
Siemens

SCALANCE XRM334 (2x230V AC, 2x10G, 24xSFP, 8xSFP+) · 0 to before V3.3
Siemens

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

Component: pam_cap
File: pam_cap/pam_cap.c

Attack conditions (Vendor/CNA, CVSS 3.1): Local · Low privileges required · No user interaction required

What an attacker can do

Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames. Vendor/CNA’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality impact as low; integrity impact as high; availability impact as none.