Search for vulnerabilities
Vulnerability details: VCID-mert-stnf-y3ff
Vulnerability ID VCID-mert-stnf-y3ff
Aliases CVE-2025-0620
Summary A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.
Status Published
Exploitability 0.5
Weighted Severity 5.9
Risk 3.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-552 Files or Directories Accessible to External Parties
System Score Found at
cvssv3 6.6 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0620.json
cvssv3.1 6.6 https://access.redhat.com/security/cve/CVE-2025-0620
ssvc Track https://access.redhat.com/security/cve/CVE-2025-0620
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.0004 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
epss 0.00053 https://api.first.org/data/v1/epss?cve=CVE-2025-0620
cvssv3.1 6.6 https://bugzilla.redhat.com/show_bug.cgi?id=2370453
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2370453
cvssv3.1 6.8 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 6.6 https://nvd.nist.gov/vuln/detail/CVE-2025-0620
archlinux Low https://security.archlinux.org/AVG-2892
cvssv3.1 6.6 https://www.samba.org/samba/security/CVE-2025-0620.html
ssvc Track https://www.samba.org/samba/security/CVE-2025-0620.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0620.json
https://api.first.org/data/v1/epss?cve=CVE-2025-0620
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
http://www.openwall.com/lists/oss-security/2025/06/03/8
1107248 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1107248
ASA-202506-3 https://security.archlinux.org/ASA-202506-3
AVG-2892 https://security.archlinux.org/AVG-2892
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
CVE-2025-0620 https://access.redhat.com/security/cve/CVE-2025-0620
CVE-2025-0620 https://nvd.nist.gov/vuln/detail/CVE-2025-0620
CVE-2025-0620.html https://www.samba.org/samba/security/CVE-2025-0620.html
show_bug.cgi?id=2370453 https://bugzilla.redhat.com/show_bug.cgi?id=2370453
USN-7564-1 https://usn.ubuntu.com/7564-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-0620.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/security/cve/CVE-2025-0620
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-06T13:41:20Z/ Found at https://access.redhat.com/security/cve/CVE-2025-0620
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.redhat.com/show_bug.cgi?id=2370453
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-06T13:41:20Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2370453
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2025-0620
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H Found at https://www.samba.org/samba/security/CVE-2025-0620.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-06-06T13:41:20Z/ Found at https://www.samba.org/samba/security/CVE-2025-0620.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.11632
EPSS Score 0.0004
Published At June 7, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-06-03T20:14:56.619979+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 36.1.0