{"id":"CVE-2021-25321","aliases":["EUVD-2021-12218","GHSA-p5jf-rf9m-p26h","MGASA-2021-0515","SUSE-SU-2021:14759-1","SUSE-SU-2021:2175-1","SUSE-SU-2021:2177-1","UBUNTU-CVE-2021-25321","openSUSE-SU-2021:0945-1","openSUSE-SU-2021:2177-1","openSUSE-SU-2024:10634-1"],"status":"published","title":"arpwatch: Local privilege escalation from runtime user to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00441,"percentile":0.38771,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-59","CWE-61"],"published":"2021-06-28T13:46:27Z","modified":"2026-06-17T03:41:49Z","fixes":[{"ecosystem":"Mageia:8","package":"arpwatch","fixed_in":["2.1a15-21.2.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"arpwatch","fixed_in":["2.1a15-131.23.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"arpwatch","fixed_in":["2.1a15-131.23.2.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"arpwatch","fixed_in":["2.1a15-159.9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.0","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.0","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 6","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.2","package":"arpwatch","fixed_in":["2.1a15-lp152.6.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"arpwatch","fixed_in":["2.1a15-5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"arpwatch","fixed_in":["3.1-1.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:8","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-21.2.mga8"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-131.23.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-131.23.2.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-159.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1a15-2"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-lp152.6.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1a15-5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"arpwatch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1-1.2"}]}]}],"products":[{"vendor":"opensuse","product":"factory"},{"vendor":"opensuse","product":"leap 15.2"},{"vendor":"suse","product":"arpwatch"},{"vendor":"suse","product":"suse linux enterprise server 11-sp4-ltss"},{"vendor":"suse","product":"suse manager server 4.0"},{"vendor":"suse","product":"suse openstack cloud crowbar 9"}],"references":[{"url":"https://bugzilla.suse.com/show_bug.cgi?id=1186240","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-25321"},{"url":"https://github.com/advisories/GHSA-p5jf-rf9m-p26h"},{"url":"https://advisories.mageia.org/MGASA-2021-0515.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29188","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-June/009098.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/Y7SKTH3533HITV3EN436RULMJP2HHQND/","tags":["web","advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-202114759-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1186240","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-25321","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212175-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20212177-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-25321","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-25321","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DE7IGDIJ6QCS3LA5C7SC67VRDUWKSAEV/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-25321","title":"arpwatch: Local privilege escalation from runtime user to root","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","status":"published","published":"2021-06-30T08:25:12.75Z","modified":"2024-09-16T18:43:24.802Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:32:59.802172Z"}],"euvd":[{"id":"EUVD-2021-12218","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","status":"published","published":"2021-06-30T08:25:12Z","modified":"2024-09-16T18:43:24Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T00:55:30.209098Z"}],"ghsa":[{"id":"GHSA-p5jf-rf9m-p26h","title":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise...","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","status":"published","published":"2022-05-24T19:06:40Z","modified":"2023-01-30T05:02:06Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-59","CWE-61"],"updated_at":"2026-11-02T14:46:33.666288Z"}],"nvd":[{"id":"CVE-2021-25321","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","status":"published","published":"2021-06-30T09:15:08.15Z","modified":"2026-06-17T03:41:49.507Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-61"],"updated_at":"2026-11-02T14:06:55.259633Z"}],"osv":[{"id":"UBUNTU-CVE-2021-25321","description":"A UNIX Symbolic Link (Symlink) Following vulnerability in arpwatch of SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Manager Server 4.0, SUSE OpenStack Cloud Crowbar 9; openSUSE Factory, Leap 15.2 allows local attackers with control of the runtime user to run arpwatch as to escalate to root upon the next restart of arpwatch. This issue affects: SUSE Linux Enterprise Server 11-SP4-LTSS arpwatch versions prior to 2.1a15. SUSE Manager Server 4.0 arpwatch versions prior to 2.1a15. SUSE OpenStack Cloud Crowbar 9 arpwatch versions prior to 2.1a15. openSUSE Factory arpwatch version 2.1a15-169.5 and prior versions. openSUSE Leap 15.2 arpwatch version 2.1a15-lp152.5.5 and prior versions.","status":"published","published":"2021-06-30T09:15:00Z","modified":"2025-10-24T04:50:10Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"MGASA-2021-0515","title":"Updated arpwatch packages fix security vulnerability","description":"A symbolic link (Symlink) following vulnerability in arpwatch allows local\nattackers with control of the runtime user to run arpwatch and to escalate\nto root upon the next restart of arpwatch. (CVE-2021-25321)\n","status":"published","published":"2021-11-20T19:31:06Z","modified":"2026-04-16T04:42:11.558635827Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:0945-1","title":"Security update for arpwatch","description":"This update for arpwatch fixes the following issues:\n\n- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-07-01T04:53:43Z","modified":"2026-02-04T03:44:03.96596Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:2177-1","title":"Security update for arpwatch","description":"This update for arpwatch fixes the following issues:\n\n- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).\n","status":"published","published":"2021-07-11T05:55:15Z","modified":"2026-02-04T03:34:20.478751Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10634-1","title":"arpwatch-3.1-1.2 on GA media","description":"These are all security issues fixed in the arpwatch-3.1-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:56:48.759066Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:14759-1","title":"Security update for arpwatch","description":"This update for arpwatch fixes the following issues:\n\n- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).\n","status":"published","published":"2021-06-28T13:47:09Z","modified":"2026-02-04T04:04:58.597353Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2175-1","title":"Security update for arpwatch","description":"This update for arpwatch fixes the following issues:\n\n- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).\n","status":"published","published":"2021-06-28T13:46:27Z","modified":"2025-05-02T04:10:35.522972Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:2177-1","title":"Security update for arpwatch","description":"This update for arpwatch fixes the following issues:\n\n- CVE-2021-25321: Fixed local privilege escalation from runtime user to root (bsc#1186240).\n","status":"published","published":"2021-06-28T13:48:09Z","modified":"2026-02-04T04:39:16.612372Z","updated_at":"2026-11-02T15:53:49.138643Z"}]}}