CVE-2025-54471

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-54471", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "state": "PUBLISHED", "assignerShortName": "suse", "dateReserved": "2025-07-23T08:11:16.426Z", "datePublished": "2025-10-30T09:45:56.931Z", "dateUpdated": "2025-10-30T13:59:54.426Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageName": "github.com/neuvector/neuvector", "product": "neuvector", "vendor": "SUSE", "versions": [{"lessThan": "5.4.7", "status": "affected", "version": "5.3.0", "versionType": "semver"}, {"lessThan": "0.0.0-20251020133207-084a437033b4", "status": "affected", "version": "0.0.0-20230727023453-1c4957d53911", "versionType": "semver"}]}], "datePublic": "2025-10-21T18:26:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "NeuVector used a hard-coded cryptographic key embedded in the source \ncode. At compilation time, the key value was replaced with the secret \nkey value and used to encrypt sensitive configurations when NeuVector \nstores the data.<br>"}], "value": "NeuVector used a hard-coded cryptographic key embedded in the source \ncode. At compilation time, the key value was replaced with the secret \nkey value and used to encrypt sensitive configurations when NeuVector \nstores the data."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-321", "description": "CWE-321: Use of Hard-coded Cryptographic Key", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-10-30T09:45:56.931Z"}, "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471"}, {"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x"}], "source": {"discovery": "UNKNOWN"}, "title": "NeuVector is shipping cryptographic material into its binary", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-30T13:59:48.001541Z", "id": "CVE-2025-54471", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T13:59:54.426Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54471", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-30T13:59:48.001541Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-30T13:59:51.238Z"}}], "cna": {"title": "NeuVector is shipping cryptographic material into its binary", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SUSE", "product": "neuvector", "versions": [{"status": "affected", "version": "5.3.0", "lessThan": "5.4.7", "versionType": "semver"}, {"status": "affected", "version": "0.0.0-20230727023453-1c4957d53911", "lessThan": "0.0.0-20251020133207-084a437033b4", "versionType": "semver"}], "packageName": "github.com/neuvector/neuvector", "defaultStatus": "unaffected"}], "datePublic": "2025-10-21T18:26:00.000Z", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471"}, {"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x"}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "NeuVector used a hard-coded cryptographic key embedded in the source \ncode. At compilation time, the key value was replaced with the secret \nkey value and used to encrypt sensitive configurations when NeuVector \nstores the data.", "supportingMedia": [{"type": "text/html", "value": "NeuVector used a hard-coded cryptographic key embedded in the source \ncode. At compilation time, the key value was replaced with the secret \nkey value and used to encrypt sensitive configurations when NeuVector \nstores the data.<br>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-321", "description": "CWE-321: Use of Hard-coded Cryptographic Key"}]}], "providerMetadata": {"orgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "shortName": "suse", "dateUpdated": "2025-10-30T09:45:56.931Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54471", "state": "PUBLISHED", "dateUpdated": "2025-10-30T13:59:54.426Z", "dateReserved": "2025-07-23T08:11:16.426Z", "assignerOrgId": "404e59f5-483d-4b8a-8e7a-e67604dd8afb", "datePublished": "2025-10-30T09:45:56.931Z", "assignerShortName": "suse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "github.com/neuvector/neuvector", "product": "neuvector", "vendor": "SUSE", "versions": [{"lessThan": "5.4.7", "status": "affected", "version": "5.3.0", "versionType": "semver"}, {"lessThan": "0.0.0-20251020133207-084a437033b4", "status": "affected", "version": "0.0.0-20230727023453-1c4957d53911", "versionType": "semver"}]}], "source": "meissner@suse.de"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NeuVector used a hard-coded cryptographic key embedded in the source \ncode. At compilation time, the key value was replaced with the secret \nkey value and used to encrypt sensitive configurations when NeuVector \nstores the data."}, {"lang": "es", "value": "NeuVector utiliz\u00f3 una clave criptogr\u00e1fica codificada de forma r\u00edgida incrustada en el c\u00f3digo fuente. En el momento de la compilaci\u00f3n, el valor de la clave fue reemplazado por el valor de la clave secreta y utilizado para cifrar configuraciones sensibles cuando NeuVector almacena los datos."}], "id": "CVE-2025-54471", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "meissner@suse.de", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54471", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-30T13:59:48.001541Z", "version": "2.0.3"}}]}, "published": "2025-10-30T10:15:35.400", "references": [{"source": "meissner@suse.de", "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471"}, {"source": "meissner@suse.de", "url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x"}], "sourceIdentifier": "meissner@suse.de", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-321"}], "source": "meissner@suse.de", "type": "Secondary"}]}

{}

{"created": "2025-10-30T14:37:25.046292+00:00", "updated": "2025-10-30T14:37:25.046318+00:00", "vendors": ["suse", "suse$PRODUCT$neuvector"]}