CVE-2025-14551

CVE-2025-14551 is a credential disclosure vulnerability in Ubuntu's Subiquity installer version 24.04.4 that exposes sensitive user information during the crash reporting process. When an installation failure occurs and a user submits a bug report to Launchpad, the application may inadvertently include plaintext credentials such as Wi-Fi passwords in the attached diagnostic logs. The vulnerability carries a HIGH severity rating with a CVSS score of 8.1, requiring network access and low privileges but imposing no interaction requirements. The attack vector is network-based, the attack complexity is low, and the confidentiality impact is high, potentially exposing sensitive authentication credentials to unauthorized parties. Additionally, the vulnerability poses availability concerns in the scope of affected systems. While CVE-2025-14551 does not currently appear on the Known Exploited Vulnerabilities (KEV) catalog, it has been marked as active on the Hot List, indicating community attention and relevant threat activity. The EPSS score of 0.00044 suggests relatively low probability of exploitation compared to the broader CVE landscape, though the credential disclosure nature of this issue warrants prompt patching to prevent potential unauthorized access to user networks and systems.