CVE-2025-14558
HIGHCVSS v3
7.2
HIGH
EPSS Score
61.4%
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
Technical Details
- CVSS v3 Vector
- 3.1
- Published
- 3/9/2026
- Last Modified
- 3/17/2026
- Exploit-DB
- EDB-52463
Frequently Asked Questions
What is CVE-2025-14558?
The rtsol(8) and rtsold(8) programs do not validate the domain search list options provided in router advertisement messages; the option body is passed to resolvconf(8) unmodified. resolvconf(8) is a shell script which does not validate its input. A lack of quoting meant that shell commands pass as input to resolvconf(8) may be executed.
Is CVE-2025-14558 actively exploited?
Active exploitation of CVE-2025-14558 has not been confirmed. The EPSS score is 61.4%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2025-14558?
CVE-2025-14558 has a CVSS v3 base score of 7.2 (HIGH severity), with vector string 3.1.
Is CVE-2025-14558 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.