CVE-2009-3525

CVE-2009-3525 describes a local authentication bypass vulnerability in the pyGrub boot loader within Xen versions 3.0.3, 3.3.0, and 3.3.1. This flaw allows an attacker with console access to a para-virtualized guest to bypass grub.conf password protection, enabling them to boot the guest or alter kernel boot parameters without authorization. With a CVSS score of 7.2, this vulnerability is considered high severity due to its low attack complexity and potential for complete compromise of confidentiality, integrity, and availability (C:C/I:C/A:C) from a local attack vector. While not listed in CISA's KEV catalog, an exploit (EDB-33255) is publicly available, though there is no evidence of active exploitation or significant community discussion.