CVE-2025-9039

Aug. 15, 2025, 1:12 p.m.

5.3
Medium

Description

We identified an issue in the Amazon ECS agent where, under certain conditions, an introspection server could be accessed off-host by another instance if the instances are in the same security group or if their security groups allow incoming connections that include the port where the server is hosted. This issue does not affect instances where the option to allow off-host access to the introspection server is set to 'false'. This issue has been addressed in ECS agent version 1.97.1. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes. If customers cannot update to the latest AMI, they can modify the Amazon EC2 security groups to restrict incoming access to the introspection server port (51678).

Product(s) Impacted

Vendor Product Versions
Amazon
  • Ecs Agent
  • 1.97.1

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-277
Insecure Inherited Permissions
A product defines a set of insecure permissions that are inherited by objects that are created by the program.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a amazon ecs_agent 1.97.1 / / / / / / /

References

https://aws.amazon.com/security/security-bulletins/AWS-2025-018/
https://github.com/aws/amazon-ecs-agent/releases/tag/v1.97.1
https://github.com/aws/amazon-ecs-agent/security/advisories/GHSA-wm7x-ww72-r77q

Tags

CWE-277
ff89ba41-3aa1-4d27-914a-91399e9639e5
2025-08-14
CVE-2025-9039

CVSS Score

5.3 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: Aug. 14, 2025, 5:15 p.m.
Last Modified: Aug. 15, 2025, 1:12 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

ff89ba41-3aa1-4d27-914a-91399e9639e5

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.