CVE-2025-67603: 
Linux Debian vulnerability analysis and mitigation

CVE-2025-67603 is an Improper Authorization vulnerability in Foomuuri, a Linux firewall management tool, that allows arbitrary local users to influence the firewall configuration via D-Bus without proper authorization checks. The vulnerability affects all Foomuuri versions prior to 0.31. It was disclosed on January 7–8, 2026, with the CVE assigned by SUSE. The CVSS v4.0 base score is 5.1 (Medium), as assessed by the CNA (SUSE) (OpenSUSE Security, SUSE Bugzilla).

The root cause is CWE-285 (Improper Authorization): Foomuuri's D-Bus interface fails to enforce adequate authorization checks, allowing any local user — regardless of privilege level — to send D-Bus messages that modify firewall rules and configuration. The attack vector is local (AV:L), requires no privileges (PR:N), no user interaction (UI:N), and no special attack conditions (AT:N). A technical write-up published by the OpenSUSE security team describes the issue as a lack of D-Bus authorization in Foomuuri's service interface, and the vulnerability was also disclosed on the oss-security mailing list (OpenSUSE Security, oss-security).

Successful exploitation allows an unprivileged local user to alter firewall rules, potentially opening ports, disabling filtering policies, or bypassing network access controls enforced by Foomuuri. This could expose services that were previously protected, facilitate lateral movement within a network, or enable further attacks against the host or adjacent systems. Confidentiality, integrity, and availability impacts are all rated Low in the CVSS v4.0 assessment, reflecting limited but meaningful security policy bypass (OpenSUSE Security, SUSE Bugzilla).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-67603. The EPSS score is approximately 0.014% (0.000140), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access to the affected system, which limits the attack surface compared to remotely exploitable vulnerabilities (OpenSUSE Security, oss-security).

1. Gain local access: Obtain a shell on a system running a vulnerable version of Foomuuri (before 0.31), for example via a low-privileged user account.
2. Identify the D-Bus interface: Use busctl or gdbus to enumerate available D-Bus services and locate the Foomuuri service interface (e.g., busctl list or gdbus introspect --system --dest <foomuuri-service>).
3. Send unauthorized D-Bus messages: Without any privilege escalation, craft and send D-Bus method calls to the Foomuuri service to modify firewall rules — such as opening ports, removing filtering rules, or altering zone assignments — since no authorization check is enforced.
4. Verify firewall change: Confirm the firewall configuration has been altered using standard tools (e.g., foomuuri show or nftables inspection commands), achieving the objective of bypassing network security controls (OpenSUSE Security, oss-security).

• Logs: Unexpected D-Bus method calls to the Foomuuri service from non-root or non-administrative users visible in system journal (journalctl -u foomuuri or journalctl --system).
• Firewall State: Unexplained changes to firewall rules or zone configurations detectable via foomuuri show or direct inspection of nftables ruleset (nft list ruleset).
• Process/D-Bus Activity: Unusual busctl or gdbus invocations by unprivileged users in process audit logs (auditd) or shell history files.

The vendor (FoobarOy) has released Foomuuri version 0.31, which addresses this vulnerability by implementing proper D-Bus authorization checks. Users should upgrade to version 0.31 or later as the primary remediation. Debian issued DSA-6095-1 and Ubuntu issued USN-8326-1 for their respective packages; Fedora also released updated packages. As a temporary workaround, restricting local user access to the system or limiting D-Bus access via polkit policies may reduce exposure until patching is possible (OpenSUSE Security, Debian Advisory, Ubuntu Advisory).

The OpenSUSE security team published a detailed advisory on January 7, 2026, describing the lack of D-Bus authorization in Foomuuri, and the issue was disclosed on the oss-security mailing list shortly after (OpenSUSE Security, oss-security). Security news outlet SecurityOnline.info covered the vulnerability under the headline "Wide Open Firewall: Critical Foomuuri Flaws Let Local Users Take Control" (SecurityOnline). The OpenSUSE planet blog and German Linux news site Pro-Linux.de also covered the issue, reflecting moderate community awareness within the Linux security ecosystem.