LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25660: A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where i...

A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph service via a packet sniffer and perform actions allowed by the Ceph service. This issue is a reintroduction of CVE-2018-1128, affecting the msgr2 protocol. The msgr 2 protocol is used for all communication except older clients that do not support the msgr2 protocol. The msgr1 protocol is not affected. The highest threat from this vulnerability is to confidentiality, integrity, and system availability.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Ceph storage clusters using affected Cephx authentication could let someone already on the cluster network reuse captured authentication traffic. That could let them act as a Ceph client and access or change data within the permissions accepted by the service.

Executive priority

Treat this as a priority fix for production Ceph storage. The vulnerability is not described as internet-scale or actively exploited, but compromise of storage authentication can affect confidentiality, integrity, and availability of business data.

Technical view

CVE-2020-25660 is a CWE-294 replay weakness in Cephx affecting Ceph versions before 15.2.6 and before 14.2.14. The issue affects msgr2 protocol communication; msgr1 is stated as not affected. It reintroduces CVE-2018-1128 behavior in msgr2.

Likely exposure

Exposure is most likely in Ceph Nautilus or Octopus deployments below 14.2.14 or 15.2.6, especially where untrusted systems can reach the Ceph cluster network. Older clients using only msgr1 are not described as affected by this issue.

Exploitation context

The source bundle does not show CISA KEV listing or confirmed active exploitation. The attack requires access to the Ceph cluster network and captured authentication traffic, reducing internet-wide exposure but creating serious risk inside flat or poorly segmented infrastructure.

Researcher notes

Evidence is strongest for affected versions, protocol scope, and fixed release thresholds. The bundle lacks CVSS details and does not provide exploit-in-the-wild evidence. Avoid assuming impact beyond actions allowed by the Ceph service after replayed authentication.

Mitigation direction

  • Upgrade Ceph to 15.2.6 or later for Octopus deployments.
  • Upgrade Ceph to 14.2.14 or later for Nautilus deployments.
  • Apply Fedora or Gentoo package updates where Ceph is distribution-managed.
  • Restrict Ceph cluster network access to trusted hosts only.
  • Review vendor guidance for unsupported or mixed-version clusters.

Validation and detection

  • Inventory Ceph versions across monitors, managers, OSDs, clients, and gateways.
  • Confirm whether deployments use msgr2 for Ceph cluster communication.
  • Check that all Nautilus nodes are at least 14.2.14.
  • Check that all Octopus nodes are at least 15.2.6.
  • Review network segmentation around Ceph cluster traffic.
Prepared
Confidence
high
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-294: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2020-25660 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/acephAll ceph versions before 15.2.6 and before 14.2.14Listed
Weakness

CWE details

CWE-294

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-294 · source CWE mapping

Authentication Bypass by Capture-replay

Authentication Bypass by Capture-replay represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs