# CVE-2025-4404

## Summary

- **CVE ID:** CVE-2025-4404
- **Severity:** CRITICAL
- **CVSS Score:** 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
- **CWE:** CWE-1220
- **Published:** Jun 17, 2025
- **Last Modified:** Jun 30, 2026

## Description

A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonical name as the REALM admin. When a successful attack happens, the user can retrieve a Kerberos ticket in the name of this service, containing the admin@REALM credential. This flaw allows an attacker to perform administrative tasks over the REALM, leading to access to sensitive data and sensitive data exfiltration.

## Affected Products

- Unknown product (0)
- Red Hat — Red Hat Enterprise Linux 10 (0:4.12.2-15.el10_0.1)
- Red Hat — Red Hat Enterprise Linux 7 Extended Lifecycle Support (0:4.6.8-5.el7_9.18)
- Red Hat — Red Hat Enterprise Linux 8 (8100020250603150652.143e9e98)
- Red Hat — Red Hat Enterprise Linux 8 (8100020250603134209.823393f5)
- Red Hat — Red Hat Enterprise Linux 8.2 Advanced Update Support (8020020250609031831.50ea30f9)
- Red Hat — Red Hat Enterprise Linux 8.2 Advanced Update Support (8020020250609030144.792f4060)
- Red Hat — Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (8040020250609101903.f153676a)
- Red Hat — Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support (8040020250609095221.5b01ab7e)
- Red Hat — Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (8060020250606060927.c1533a64)
- Red Hat — Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support (8060020250606060504.ada582f1)
- Red Hat — Red Hat Enterprise Linux 8.6 Telecommunications Update Service (8060020250606060927.c1533a64)
- Red Hat — Red Hat Enterprise Linux 8.6 Telecommunications Update Service (8060020250606060504.ada582f1)
- Red Hat — Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (8060020250606060927.c1533a64)
- Red Hat — Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions (8060020250606060504.ada582f1)
- Red Hat — Red Hat Enterprise Linux 8.8 Telecommunications Update Service (8080020250604195510.e581a9e4)
- Red Hat — Red Hat Enterprise Linux 8.8 Telecommunications Update Service (8080020250604202433.b0a6ceea)
- Red Hat — Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (8080020250604195510.e581a9e4)
- Red Hat — Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions (8080020250604202433.b0a6ceea)
- Red Hat — Red Hat Enterprise Linux 9 (0:4.12.2-14.el9_6.1)
- Red Hat — Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions (0:4.9.8-11.el9_0.4)
- Red Hat — Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions (0:4.10.1-12.el9_2.4)
- Red Hat — Red Hat Enterprise Linux 9.4 Extended Update Support (0:4.11.0-15.el9_4.5)

## References

- [CNA](https://access.redhat.com/errata/RHSA-2025:9184)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9185)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9186)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9187)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9188)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9189)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9190)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9191)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9192)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9193)
- [CNA](https://access.redhat.com/errata/RHSA-2025:9194)
- [CNA](https://access.redhat.com/security/cve/CVE-2025-4404)
- [CNA](https://bugzilla.redhat.com/show_bug.cgi?id=2364606)
- [CNA](https://pagure.io/freeipa/c/6b9400c135ed16b10057b350cc9ce42aa0e862d4)
- [CNA](https://pagure.io/freeipa/c/796ed20092d554ee0c9e23295e346ec1e8a0bf6e)
- [CVE](http://www.openwall.com/lists/oss-security/2025/09/30/6)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 1.97%
- **EPSS Percentile:** 79.2

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-11._