{"id":"CVE-2025-9615","state":"PUBLISHED","title":"Networkmanager: networkmanager file access","description":"A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection.","publishedAt":"2026-01-26T19:58:17.401Z","updatedAt":"2026-06-30T07:37:54.378Z","severity":{"score":3.3,"label":"Low","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","source":"redhat"},"assigner":"redhat","products":["Red Hat Red Hat Enterprise Linux 10","Red Hat Red Hat Enterprise Linux 9","Red Hat Red Hat Enterprise Linux 6","Red Hat Red Hat Enterprise Linux 7","Red Hat Red Hat Enterprise Linux 8","Red Hat Red Hat OpenShift Container Platform 4"],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.56.0-1.el10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.54.3-2.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.54.3-2.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"NetworkManager","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":["https://access.redhat.com/errata/RHSA-2026:18142","https://access.redhat.com/errata/RHSA-2026:18597","https://access.redhat.com/security/cve/CVE-2025-9615","https://bugzilla.redhat.com/show_bug.cgi?id=2391503","https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809","https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324","https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2327"],"weaknesses":["CWE-281"],"ingestedAt":"2026-10-29T20:10:13.529Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/9xxx/CVE-2025-9615.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-9615","state":"PUBLISHED","datePublished":"2026-01-26T19:58:17.401Z","dateUpdated":"2026-06-30T07:37:54.378Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateReserved":"2025-08-28T15:52:57.853Z"},"containers":{"cna":{"title":"Networkmanager: networkmanager file access","descriptions":[{"lang":"en","value":"A flaw was found in NetworkManager. The NetworkManager package allows access to files that may belong to other users. NetworkManager allows non-root users to configure the system's network. The daemon runs with root privileges and can access files owned by users different from the one who added the connection."}],"affected":[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.56.0-1.el10","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:10.2"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.54.3-2.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","packageName":"NetworkManager","defaultStatus":"affected","versions":[{"version":"1:1.54.3-2.el9","status":"unaffected","lessThan":"*","versionType":"rpm"}],"collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:enterprise_linux:9::appstream","cpe:/a:redhat:enterprise_linux:9::crb","cpe:/o:redhat:enterprise_linux:9::baseos"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","packageName":"NetworkManager","defaultStatus":"unknown","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","packageName":"NetworkManager","defaultStatus":"affected","collectionURL":"https://access.redhat.com/downloads/content/package-browser/","cpes":["cpe:/a:redhat:openshift:4"]}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2026:18142","name":"RHSA-2026:18142","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:18597","name":"RHSA-2026:18597","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-9615","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2391503","name":"RHBZ#2391503","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/issues/1809"},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2324"},{"url":"https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/merge_requests/2327"}],"metrics":[{"other":{"content":{"value":"Low","namespace":"https://access.redhat.com/security/updates/classification/"},"type":"Red Hat severity rating"}},{"cvssV3_0":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"NONE","baseScore":3.3,"baseSeverity":"LOW","confidentialityImpact":"LOW","integrityImpact":"NONE","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.0"},"format":"CVSS"}],"problemTypes":[{"descriptions":[{"cweId":"CWE-281","description":"Improper Preservation of Permissions","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"redhat","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateUpdated":"2026-06-30T07:37:54.378Z"},"datePublic":"2025-12-12T00:00:00.000Z","x_redhatCweChain":"CWE-281: Improper Preservation of Permissions","workarounds":[{"lang":"en","value":"SELinux is shipped out of the box in targeted enforcing mode, which prevents processes from having unwanted permissions and mitigates this attack."}],"timeline":[{"lang":"en","time":"2025-08-28T15:55:54.627Z","value":"Reported to Red Hat."},{"lang":"en","time":"2025-12-12T00:00:00.000Z","value":"Made public."}],"x_generator":{"engine":"cvelib 1.8.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-01-26T20:14:39.211829Z","id":"CVE-2025-9615","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-01-26T20:15:40.818Z"}}]}}}