Today, Immersive's Container 7 Research Team have released a new CTI lab covering a critical vulnerability in Docker Engine with a CVSS score of 9.3, making this a critical vulnerability.
Pvotal Technologies published a write-up for a vulnerability in Docker Engine, given a CVSS score of 9.3. CVE-2025-9074 is a flaw in Docker Desktop that exposes the Docker Engine API to any container, with no authentication. Exploitation of this critical vulnerability allows a low-privileged container to issue privileged API commands, take over other containers, and, in some cases, mount the host drive and access files and folders and eventually achieve remote code execution.
Why should our customers care?
Many organizations rely on containerization in their development teams, and a vulnerability like this could allow an attacker to gain access to any to developer's workstation by mounting a developer's host drive. The possibility of supply chain attacks is increased due to malicious containers that can be used by developers, which can have start-up scripts that mount and "escape" the containerized environment.
Who is the defensive lab for?
- System Administrators
- Developers
- SOC Analysts
- Incident Responders
- Threat Hunting
Here are the links to the labs:
Immerser
Immerser