CVE-2025-66002
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
An improper neutralization of argument delimiters in a command (Argument Injection) vulnerability allows local users to perform arbitrary unmounts via the smb4k mount helper.
Risk Assessment
A local user can perform unauthorized unmount operations, potentially leading to system disruption or data loss.
Recommendation
Update smb4k to the latest version that includes the fix. Restrict local users' access to the mount helper.
Other vulnerabilities in smb4k
See all- CVE-2017-8849High
smb4k before 2.0.1 allows local users to gain root privileges by leveraging failure to verify arguments to the mount helper DBUS service.
- CVE-2025-66003High
An External Control of File Name or Path vulnerability in smb4k before version 4.0.5 allows local users to perform a local root exploit via smb4k mounthelper if they can access and control the contents of a Samba share.
Original NVD description (English source)
An Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability allows local users ton perform arbitrary unmounts via smb4k mount helper
Vulnerability data from NVD (NIST) · CISA KEV · EPSS