The vulnerability in firewalld occurs when two runtime D‑Bus setters, setZoneSettings2 and setPolicySettings, are mis‑authorized. A local unprivileged user can invoke these setters without proper authentication, allowing the user to change the firewall configuration at runtime. This leads to unauthorized changes in network security settings such as opening ports or altering zones, thereby undermining the protection intended by the firewall.

Affected products include Red Hat Enterprise Linux 7 through 10 and Red Hat OpenShift Container Platform 4. All versions of the firewalld service shipped with these distributions are susceptible; no specific sub‑versions are listed.

The CVSS score of 5.5 indicates a moderate impact. The exploit probability is not reported, and the vulnerability is not listed in CISA’s KEV catalog, suggesting a lower likelihood of widespread exploitation. The attack vector is local; an attacker must have an account on the host and may already have ordinary user privileges. Once the unprivileged user invokes the mis‑authorized D‑Bus calls, the firewall state can be altered immediately, potentially exposing services to the outside world or bypassing security policies.