CVE-2025-54388

MEDIUM EPSS 10.1%
Published Jul 30, 202511mo ago · Modified Jun 17, 20262w ago
5.1 CVSS 4.0
Medium
Find Similar
Published Jul 30, 2025 11mo ago
Last Modified Jun 17, 2026 2w ago

Description

Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. In versions 28.2.0 through 28.3.2, when the firewalld service is reloaded it removes all iptables rules including those created by Docker. While Docker should automatically recreate these rules, versions before 28.3.3 fail to recreate the specific rules that block external access to containers. This means that after a firewalld reload, containers with ports published to localhost (like 127.0.0.1:8080) become accessible from remote machines that have network routing to the Docker bridge, even though they should only be accessible from the host itself. The vulnerability only affects explicitly published ports - unpublished ports remain protected. This issue is fixed in version 28.3.3.

CVSS Details

Base Score
5.1
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction P
Scope X

Threat Intelligence

EPSS Exploit Probability
10.1% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-909

Affected Products 1

VendorProductVersionRange
mobyprojectmoby*≥28.2.0  –  <28.3.3

References 3

  • github.com https://github.com/moby/moby/commit/bea959c7b793b32a893820b97c4eadc7c87fabb0
    Patch
  • github.com https://github.com/moby/moby/pull/50506
    Issue TrackingPatch
  • github.com https://github.com/moby/moby/security/advisories/GHSA-x4rx-4gw3-53p4
    Vendor Advisory

Remediation

  • github.com https://github.com/moby/moby/commit/bea959c7b793b32a893820b97c4eadc7c87fabb0
    Patch
  • github.com https://github.com/moby/moby/pull/50506
    Issue TrackingPatch