CVE record · CVE-2025-4404

Freeipa: idm: privilege escalation from host to domain admin in freeipa

CVSS 9.1 CriticalCriticalEPSS 0.020 · 80th percentile

Critical, because:

CVSS score 9.1: 9.0 or more.

Published by the CVE Program (CNA: redhat) at 17 Jun 2025, 13:39 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Not given	Not given Package name: freeipa https://www.freeipa.org/	affected before 4.12.4 semver Other versions: unaffected
Red Hat	Red Hat Enterprise Linux 10 Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.12.2-15.el10_0.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 7 Extended Lifecycle Support Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.6.8-5.el7_9.18 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8100020250603150652.143e9e98 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8 Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8100020250603134209.823393f5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020250609031831.50ea30f9 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.2 Advanced Update Support Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8020020250609030144.792f4060 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020250609101903.f153676a to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8040020250609095221.5b01ab7e to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060927.c1533a64 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060504.ada582f1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060927.c1533a64 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Telecommunications Update Service Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060504.ada582f1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060927.c1533a64 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8060020250606060504.ada582f1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020250604195510.e581a9e4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Telecommunications Update Service Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020250604202433.b0a6ceea to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: idm:client https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020250604195510.e581a9e4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Package name: idm:DL1 https://access.redhat.com/downloads/content/package-browser/	unaffected 8080020250604202433.b0a6ceea to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9 Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.12.2-14.el9_6.1 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.9.8-11.el9_0.4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.10.1-12.el9_2.4 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 9.4 Extended Update Support Package name: ipa https://access.redhat.com/downloads/content/package-browser/	unaffected 0:4.11.0-15.el9_4.5 to before * rpm Other versions: affected
Red Hat	Red Hat Enterprise Linux 6 Package name: ipa https://access.redhat.com/downloads/content/package-browser/	No versions given Other versions: unknown

Identifiers: CVE-2025-4404
CNA: redhat
Weakness (CWE): CWE-1220
Tags: Red Hat Enterprise Linux 10
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat Enterprise Linux 8
Red Hat Enterprise Linux 8.2 Advanced Update Support
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
CWE-1220
Published: 17 Jun 2025
Updated: 4 Nov 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

Score	Rating	CVSS	Vector	Source
9.1	Critical	3.1	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	CNA (redhat)

CISA KEV Not listed.
EPSS 0.020, the 80th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

17 Jun 2025, 13:39 UTC Confirmed by the CVE List
17 Jun 2025, 14:15 UTC Confirmed by NVD

Sources

References from the CNA

access.redhat.com/errata/RHSA-2025:9184 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9185 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9186 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9187 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9188 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9189 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9190 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9191 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9192 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9193 vendor-advisoryredhat
access.redhat.com/errata/RHSA-2025:9194 vendor-advisoryredhat
access.redhat.com/security/cve/CVE-2025-4404 vdb-entryredhat
bugzilla.redhat.com/show_bug.cgi?id=2364606 issue-trackingredhat
pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4
pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.