Improper neutralization of special elements used in a command ('command injection') in Azure Command Line Integration (CLI) allows an unauthorized attacker to elevate privileges locally.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:0273-1 advisory.

    - CVE-2025-24049: Fix improper neutralization of special elements used in a command which allows an     unauthorized attacker to elevate privileges locally. (bsc#1239460)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1182-1 advisory.

    - CVE-2025-24049: Fixed improper neutralization of special elements used in a command       allows an unauthorized attacker to elevate privileges locally (bsc#1239460)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2025:1019-1 advisory.

    - CVE-2025-24049: Fixed improper neutralization of special elements used in a command       allows an unauthorized attacker to elevate privileges locally (bsc#1239460).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Azure CLI installation on the remote host is missing a security update. It is, therefore, affected by an elevation of privilege vulnerability. An attacker can exploit this to gain elevated privileges.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
320368	openSUSE 15: azure-cli / azure-cli-core / azure-cli-telemetry / python311-anyio / etc (SUSE-SU-SUSE-RU-2026:2237-2)	Nessus	SuSE Local Security Checks	medium
296479	SUSE SLES12 Security Update : azure-cli-core (SUSE-SU-2026:0273-1)	Nessus	SuSE Local Security Checks	high
234118	SUSE SLES15 Security Update : azure-cli-core (SUSE-SU-2025:1182-1)	Nessus	SuSE Local Security Checks	high
233396	SUSE SLES15 / openSUSE 15 Security Update : azure-cli-core (SUSE-SU-2025:1019-1)	Nessus	SuSE Local Security Checks	high
232689	Security Updates for Azure CLI (March 2025)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2025-24049

high

Tenable Plugins

medium

high

high

high

high