Security readout for executives and security teams
Plain-English summary
A local user on an affected RHEL system can interfere with another user's Lightspeed command-line assistant history. That history could be viewed, deleted, or altered to place misleading entries that encourage harmful actions.
Executive priority
Treat as high priority for shared Linux environments and administrative hosts. It is not described as remotely exploitable, but it can undermine trust in command history and support privilege misuse through deception.
Technical view
The flaw is improper access control in Lightspeed history management for command-line-assistant on RHEL 9 and 10. Unprivileged local users can abuse IPC access to the history service to read, delete, or inject another user's history entries.
Likely exposure
Exposure is limited to systems running affected Red Hat Enterprise Linux 9 or 10 command-line-assistant packages, especially shared servers, jump hosts, and administrator workstations where multiple local users use Lightspeed.
Exploitation context
The bundle reports local access and no KEV listing. It does not provide evidence of active exploitation. Impact depends on shared local access and whether tampered history can influence privileged users' actions.
Researcher notes
Sources identify CWE-284, CVSS 7.7, and affected package builds. The bundle does not include fixed package versions, proof-of-concept status, or confirmed exploitation, so remediation should track Red Hat advisories directly.
Mitigation direction
- Inventory RHEL 9 and 10 hosts with command-line-assistant installed.
- Check Red Hat RHSA-2025:16345 and RHSA-2025:16346 for approved updates.
- Apply vendor guidance before relying on local compensating controls.
- Limit unnecessary local shell access on shared administrative systems.
- Warn privileged users not to trust command history entries blindly.
Validation and detection
- Confirm installed command-line-assistant package versions on RHEL 9 and 10 systems.
- Compare package status against Red Hat advisories for this CVE.
- Review local account access on systems where Lightspeed is used.
- Check whether affected systems are shared by privileged and unprivileged users.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-284: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2025-5962 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N2.55.2redhatVulnerability scoring details
Base CVSS 3.1 score
7.7HighVector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- Source timelineredhat
Made public.
- Source timelineredhat
Reported to Red Hat.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- RHSA-2025:16345CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- RHSA-2025:16346CVE reference, redhat · vendor-advisory, x_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2025-5962CVE reference, redhat · vdb-entry, x_refsource_REDHAT
- RHBZ#2371363CVE reference, redhat · issue-tracking, x_refsource_REDHAT
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Access Control
Improper Access Control represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.