The vulnerability exists due to improper input validation within the junos module when parsing yaml files. A remote attacker can trick the victim into using a specially crafted yaml file and execute arbitrary code on the target system.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4467-1 advisory.

    venv-salt-minion:

    - Security issues fixed:

      - CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
      - CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
      - Backport security fixes for vendored tornado
        * BDSA-2024-3438
        * BDSA-2024-3439
        * BDSA-2024-9026


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4475-1 advisory.

    - Security issues fixed:

      - CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
      - CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
      - Backport security fixes for vendored tornado
        * BDSA-2024-3438
        * BDSA-2024-3439
        * BDSA-2024-9026


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4478-1 advisory.

    - Security issues fixed:

      - CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
      - CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
      - Backport security fixes for vendored tornado
        * BDSA-2024-3438
        * BDSA-2024-3439
        * BDSA-2024-9026


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4476-1 advisory.

    - Security issues fixed:

      - CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
      - CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
      - Backport security fixes for vendored tornado
        * BDSA-2024-3438
        * BDSA-2024-3439
        * BDSA-2024-9026


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4477-1 advisory.

    - Security issues fixed:

      - CVE-2025-62349: Added minimum_auth_version to enforce security (bsc#1254257)
      - CVE-2025-62348: Fixed Junos module yaml loader (bsc#1254256)
      - Backport security fixes for vendored tornado
        * BDSA-2024-3438
        * BDSA-2024-3439
        * BDSA-2024-9026


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4479-1 advisory.

    release-notes-susemanager:

    - Update to SUSE Manager 4.3.16.2
      * SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
      * CVEs Fixed:
        CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190         CVE-2025-62349, CVE-2025-62348
      * Bugs mentioned:
        bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
279377	SUSE SLES15 : Security update 5.0.6 for Multi-Linux Manager Salt Bundle (SUSE-SU-2025:4467-1)	Nessus	SuSE Local Security Checks	high
279372	SUSE SLES15 Security Update : salt (SUSE-SU-2025:4475-1)	Nessus	SuSE Local Security Checks	high
279364	SUSE SLES15 Security Update : salt (SUSE-SU-2025:4478-1)	Nessus	SuSE Local Security Checks	high
279363	SUSE SLES15 Security Update : salt (SUSE-SU-2025:4476-1)	Nessus	SuSE Local Security Checks	high
279360	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : salt (SUSE-SU-2025:4477-1)	Nessus	SuSE Local Security Checks	high
279354	SUSE SLES15 : Security update 4.3.16.2 for Multi-Linux Manager Server LTS (SUSE-SU-2025:4479-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2025-62348

high

Tenable Plugins

high

high

high

high

high

medium