CVE-2021-25321
arpwatch: Local privilege escalation from runtime user to root
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
arpwatch: Local privilege escalation from runtime user to root
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Record
CVE-2021-25321- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-61
- Updated
- 2026-11-02
EUVDEUVD-2021-12218
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Record
EUVD-2021-12218- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p5jf-rf9m-p26h
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise...
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Record
GHSA-p5jf-rf9m-p26h- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-59, CWE-61
- Updated
- 2026-11-02
NVD
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Record
CVE-2021-25321- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-61
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-25321
A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.
- Record
UBUNTU-CVE-2021-25321- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0515 No score
Updated arpwatch packages fix security vulnerability
A symbolic link (Symlink) following vulnerability in arpwatch allows local attackers with control of the runtime user to run arpwatch and to escalate to root upon the next restart of arpwatch. (CVE-2021-25321)
- Record
MGASA-2021-0515- Updated
- 2026-11-02
Show 6 moreShow less
OSVopenSUSE-SU-2021:0945-1 No score
Security update for arpwatch
This update for arpwatch fixes the following issues:
- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2021:0945-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2177-1 No score
Security update for arpwatch
This update for arpwatch fixes the following issues:
- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).
- Record
openSUSE-SU-2021:2177-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10634-1 No score
arpwatch-3.1-1.2 on GA media
These are all security issues fixed in the arpwatch-3.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10634-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:14759-1 No score
Security update for arpwatch
This update for arpwatch fixes the following issues:
- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).
- Record
SUSE-SU-2021:14759-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2175-1 No score
Security update for arpwatch
This update for arpwatch fixes the following issues:
- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).
- Record
SUSE-SU-2021:2175-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2177-1 No score
Security update for arpwatch
This update for arpwatch fixes the following issues:
- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).
- Record
SUSE-SU-2021:2177-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
arpwatchMageia:8 |
before 2.1a15-21.2.mga8 | 2.1a15-21.2.mga8 |
arpwatchSUSE:Linux Enterprise Point of Sale 11 SP3 |
before 2.1a15-131.23.2.6.1 | 2.1a15-131.23.2.6.1 |
arpwatchSUSE:Linux Enterprise Server 11 SP4-LTSS |
before 2.1a15-131.23.2.6.1 | 2.1a15-131.23.2.6.1 |
arpwatchSUSE:HPE Helion OpenStack 8 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:OpenStack Cloud 8 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:OpenStack Cloud 9 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:OpenStack Cloud Crowbar 8 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:OpenStack Cloud Crowbar 9 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
Show 26 moreShow less
| Package | Affected | Fixed |
|---|---|---|
arpwatchSUSE:Linux Enterprise Software Development Kit 12 SP5 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server 12 SP2-BCL |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server 12 SP3-BCL |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server 12 SP5 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.1a15-159.9.1 | 2.1a15-159.9.1 |
arpwatchSUSE:Linux Enterprise Module for Basesystem 15 SP2 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Module for Basesystem 15 SP3 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise High Performance Computing 15-ESPOS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise High Performance Computing 15-LTSS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Server 15-LTSS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Server 15 SP1-BCL |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Server 15 SP1-LTSS |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Server for SAP Applications 15 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Linux Enterprise Server for SAP Applications 15 SP1 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Manager Proxy 4.0 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Manager Retail Branch Server 4.0 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Manager Server 4.0 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchSUSE:Enterprise Storage 6 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchUbuntu:16.04:LTS |
All versions, plus listed versions 2.1a15-2 |
None known |
arpwatchopenSUSE:Leap 15.2 |
before 2.1a15-lp152.6.9.1 | 2.1a15-lp152.6.9.1 |
arpwatchopenSUSE:Leap 15.3 |
before 2.1a15-5.12.1 | 2.1a15-5.12.1 |
arpwatchopenSUSE:Tumbleweed |
before 3.1-1.2 | 3.1-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-25321 is a high vulnerability (CVSS 7.8) in Opensuse Factory, published June 28, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in arpwatch 2.1a15-21.2.mga8.
References
bugzilla.suse.com/show_bug.cgi?id=1186240
nvd.nist.gov/vuln/detail/CVE-2021-25321
github.com/advisories/GHSA-p5jf-rf9m-p26h
advisories.mageia.org/MGASA-2021-0515.html
bugs.mageia.org/show_bug.cgi?id=29188
lists.suse.com/pipermail/sle-security-updates/2021-June/009098.html
Show 9 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/Y7SKTH3533HITV3EN436RULMJP2HHQND
suse.com/support/update/announcement/2021/suse-su-202114759-1
ubuntu.com/security/CVE-2021-25321
cve.org/CVERecord?id=CVE-2021-25321