#VU118371 Insufficient Logging in sudo-rs - CVE-2025-64517
Published: November 12, 2025
Vulnerability identifier: #VU118371
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2025-64517
CWE-ID: CWE-778
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerable software:
sudo-rs
sudo-rs
Software vendor:
Prossimo
Prossimo
Description
The vulnerability allows a local user to hide their activity on the system.
The vulnerability exists due to sude-rs records the invoking user's UID instead of the authenticated-as user's UID in the authentication timestamp with Defaults targetpw (or Defaults rootpw) enabled. A local privileged user can run commands as any other account the policy permits them to run commands for, even if they don't know the password for those accounts.
Remediation
Install updates from vendor's website.