CVE-2025-53070
Oracle Solaris 11
Raw vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:HSummary
CVE-2025-53070 is a medium-severity Privilege Defined With Unsafe Actions (CWE-267) vulnerability in Oracle Solaris. Its CVSS base score is 5.5 (Medium).
Operationally, ranked at the 4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35264
Vulnerability Data
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle Solaris executes to compromise Oracle Solaris. Successful…
more
attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Solaris, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Solaris. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:N/I:N/A:H).
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly counters CWE-267 by restricting high-privileged accounts to only the minimal filesystem operations needed, blocking the unsafe privileged actions that lead to the DoS.
Enforces mandatory access-control checks on every filesystem operation, preventing a high-privileged local user from reaching the vulnerable code path even when logged on.
Process isolation limits the blast radius of a filesystem crash or hang so that a successful exploit cannot take down the entire Solaris instance or affect other scoped components.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Defining and enforcing least-privilege permissions directly reduces the chance that a privilege permits unintended unsafe actions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of privileged utility programs restricts dangerous tools but does not address unsafe actions within assigned privileges.
Access control policy can limit unsafe privilege use but does not define safe actions for each privilege.
Access rights assignment can restrict privileges to intended actions, yet does not guarantee the privilege itself is safe.
Segregation of duties reduces risk of unsafe actions by splitting privileges but does not address unsafe privilege definitions.
Privileged access rights control can restrict unsafe privileges, yet does not ensure the privilege definition itself is safe.
Secure development lifecycle can catch unsafe privilege definitions during design but does not prevent them at runtime.
Hardening callouts derived
Configuration rules from DISA STIG baselines that reduce the attack surface for weaknesses of the type cited by this CVE. Derived transitively via CVE→CWE→STIG over `controls_xwalks` (authoritative rows only).
Ubuntu 22.04 (1 rule)
- V-260559 Ubuntu 22.04 LTS must ensure only users who need access to security functions are part of sudo group. via CWE-267
Ubuntu 24.04 (1 rule)
- V-270675 Ubuntu 24.04 LTS when booted must require authentication upon booting into single-user and maintenance modes. via CWE-267