CVE-2025-12381 Privilege Escalation via Misconfigured Sudoers Entry for Local Users in AlgoSec Firewall Analyzer

Medium 6.1 Published 9 Dec 2025 Updated 9 Dec 2025

Local users can escalate privileges by abusing parameters in a sudoers-approved command within AlgoSec Firewall Analyzer.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2025-12381?

CVE-2025-12381 is a medium-severity vulnerability in AlgoSec Firewall Analyzer, published on 9 Dec 2025. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

Improper Privilege Management vulnerability in AlgoSec Firewall Analyzer on Linux, 64 bit allows Privilege Escalation, Parameter Injection.

A local user with access to the command line may escalate their privileges by abusing the parameters of a command that is approved in the sudoers file. This issue affects Firewall Analyzer: A33.0, A33.10.

Weakness: CWE-269

Which versions are affected by CVE-2025-12381?

It affects 1 product.

Products include Algosec Firewall Analyzer.

How do I fix CVE-2025-12381?

No fix has been published for CVE-2025-12381 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-12381 being exploited?

There is no known exploitation of CVE-2025-12381 in the wild and no public exploit code.

Sources

Also known as GHSA-mmf6-49fc-cg8h.