6.2

CVE-2025-54389: advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment Improper Output Neutralization for Logs

CVSS: 6.2v3.1MediumModified
AliasesRHSA-2025:14493RHSA-2025:14573RHSA-2025:14592
Published 14-08-2025Last modified 04-11-2025
Open JSON

Vulnerability summary

CVE-2025-54389 is a medium (CVSS 6.2) Improper Output Neutralization for Logs vulnerability in advanced_intrusion_detection_environment_project advanced_intrusion_detection_environment. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.4% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
35/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.2/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.25%
0%100%
Low · +0.02 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 7 · Related 4
DLA-4272-1DSA-5977-1MGASA-2025-0224OPENSUSE-SU-2025:15474-1SUSE-SU-2025:20657-1SUSE-SU-2025:20754-1

Timeline

  1. 14-08-2025
    PublishedVulnerability first disclosed.
  2. 04-11-2025
    Last modifiedVulnerability information updated.

Description

AIDE is an advanced intrusion detection environment. Prior to version 0.19.2, there is an improper output neutralization vulnerability in AIDE. An attacker can craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and/or tamper with the log output. A local user might exploit this to bypass the AIDE detection of malicious files. Additionally the output of extended attribute key names and symbolic links targets are also not properly neutralized. This issue has been patched in version 0.19.2. A workaround involves configuring AIDE to write the report output to a regular file, redirecting stdout to a regular file, or redirecting the log output written to stderr to a regular file.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.25%

Chance of exploitation in the next 30 days

Percentile

15%

Versus all other CVEs

30-day change

+0.02 pp

From 0.23% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.25%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Aide

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Redhat3 products
  • aide< 0:0.16-103.el9_6.2 | < 0:0.16-15.el8_10.2 | < 0:0.18.6-8.el10_0.2 | < 0:0.16-11.el8_2.2 | < 0:0.16-14.el8_4.2 | < 0:0.16-15.el8_8.1 | < 0:0.16-100.el9_2.1 | < 0:0.16-100.el9_4.1 | < 0:0.16-15.el8_6.1 | < 0:0.16-100.el9_0.1 | < 0:0.15.1-13.el7_9.5
  • aide-debuginfo< 0:0.16-103.el9_6.2 | < 0:0.16-15.el8_10.2 | < 0:0.18.6-8.el10_0.2 | < 0:0.16-11.el8_2.2 | < 0:0.16-14.el8_4.2 | < 0:0.16-15.el8_8.1 | < 0:0.16-100.el9_2.1 | < 0:0.16-100.el9_4.1 | < 0:0.16-15.el8_6.1 | < 0:0.16-100.el9_0.1 | < 0:0.15.1-13.el7_9.5
  • aide-debugsource< 0:0.16-103.el9_6.2 | < 0:0.16-15.el8_10.2 | < 0:0.18.6-8.el10_0.2 | < 0:0.16-11.el8_2.2 | < 0:0.16-14.el8_4.2 | < 0:0.16-15.el8_8.1 | < 0:0.16-100.el9_2.1 | < 0:0.16-100.el9_4.1 | < 0:0.16-15.el8_6.1 | < 0:0.16-100.el9_0.1
Advanced_intrusion_detection_environment_project1 product
Aide1 product
Debian1 product
  • aide< 0.18.3-1+deb12u4 | < 0.19.1-2+deb13u1 | < 0.19.2-1
Ubuntu1 product
  • aide< 0.16~a2.git20130520-2ubuntu0.1+esm2 | < 0.16~a2.git20130520-3ubuntu0.1~esm2 | < 0.16-3ubuntu0.1+esm1 | < 0.16.1-1ubuntu0.1+esm1 | < 0.17.4-1ubuntu0.2 | < 0.18.6-2ubuntu0.1

5 vendors · 7 products

References

35 links
Show all 35 references