CVE-2025-62877
Published: 08 January 2026
Summary
CVE-2025-62877 is a critical-severity Initialization of a Resource with an Insecure Default (CWE-1188) vulnerability in Suse (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 37.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and IA-5 (Authenticator Management).
Deeper analysis
CVE-2025-62877 is a vulnerability in the SUSE Virtualization (Harvester) environment that exposes the OS default SSH login password. It affects projects using the 1.5.x or 1.6.x interactive installer to create a new cluster or add new hosts to an existing cluster. Environments utilizing the PXE boot mechanism along with Harvester configuration setup are not affected. The issue is associated with CWE-1188 and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), published on 2026-01-08.
Attackers can exploit this vulnerability remotely over the network without authentication, privileges, or user interaction, requiring only low complexity. By accessing the exposed default SSH login password during the interactive installer process, unauthenticated remote attackers can achieve high-impact compromise, including unauthorized access to the affected OS, potentially enabling full control with significant effects on confidentiality, integrity, and availability.
Mitigation details and patches are available in the referenced advisories: SUSE Bugzilla at https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-62877 and Harvester GitHub security advisory at https://github.com/harvester/harvester/security/advisories/GHSA-6g8q-hp2j-gvwv. Security practitioners should consult these for specific remediation steps, such as avoiding the interactive installer or applying updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-0816
Vulnerability details
Projects using the SUSE Virtualization (Harvester) environment may expose the OS default ssh login password if they are using the 1.5.x or 1.6.x interactive installer to either create a new cluster or add new hosts to an existing cluster. The…
more
environment is not affected if the PXE boot mechanism is utilized along with the Harvester configuration setup.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Exposes default SSH credentials (CWE-1188) enabling remote OS access via Valid Accounts (Default Accounts) over SSH Remote Services.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely remediation of the specific flaw in the Harvester interactive installer that exposes the default SSH password, as patches are available in advisories.
Mandates changing default authenticators prior to first use, preventing exploitation of the exposed OS default SSH password.
Requires management of accounts including changing default account content and disabling unnecessary accounts, mitigating risks from the exposed default SSH credentials.