Steve, a component of the SUSE software stack, performs TLS connections using a default configuration that does not validate the server’s presented certificate. This lack of verification creates an opportunity for an attacker to intercept and potentially alter traffic between the client and the server. The primary impact is the compromise of confidentiality and integrity of data communicated over the TLS channel, exposing users to data theft, injection, or manipulation without the client knowing. The related weakness is a Certificate Validation Failure (CWE-295).

The affected product is SUSE Steve. No specific version information was supplied, so any installation using the default configuration is potentially vulnerable.

The CVSS base score of 8.0 indicates high severity, while the EPSS value of less than 1% suggests a low probability of exploitation at present. Because the vulnerability is not listed in CISA KEV, there is no current evidence of widespread exploitation. However, the attack is theoretically achievable by an adversary who can position themselves between the client and the accepted server and present a forged or self‑signed certificate, bypassing the TLS handshake when the client accepts it.