CVE-2025-64097

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64097", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-10-27T15:26:14.126Z", "datePublished": "2026-01-22T14:57:00.362Z", "dateUpdated": "2026-01-22T16:16:06.007Z"}, "containers": {"cna": {"title": "NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force", "problemTypes": [{"descriptions": [{"cweId": "CWE-330", "lang": "en", "description": "CWE-330: Use of Insufficiently Random Values", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "baseScore": 9.5, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "version": "4.0"}}], "references": [{"name": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m"}, {"name": "https://github.com/nerves-hub/nerves_hub_web/pull/2024", "tags": ["x_refsource_MISC"], "url": "https://github.com/nerves-hub/nerves_hub_web/pull/2024"}, {"name": "https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0"}], "affected": [{"vendor": "nerves-hub", "product": "nerves_hub_web", "versions": [{"version": ">= 1.0.0, < 2.3.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T14:57:00.362Z"}, "descriptions": [{"lang": "en", "value": "NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation,\nfirewalling access to the NervesHub server can help limit exposure until an upgrade is possible."}], "source": {"advisory": "GHSA-m9vj-776q-vc8m", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-22T16:15:56.743700Z", "id": "CVE-2025-64097", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:16:06.007Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64097", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-01-22T16:15:56.743700Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-22T16:16:01.292Z"}}], "cna": {"title": "NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force", "source": {"advisory": "GHSA-m9vj-776q-vc8m", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.5, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "nerves-hub", "product": "nerves_hub_web", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.3.0"}]}], "references": [{"url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m", "name": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/nerves-hub/nerves_hub_web/pull/2024", "name": "https://github.com/nerves-hub/nerves_hub_web/pull/2024", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0", "name": "https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation,\nfirewalling access to the NervesHub server can help limit exposure until an upgrade is possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-330", "description": "CWE-330: Use of Insufficiently Random Values"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-22T14:57:00.362Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64097", "state": "PUBLISHED", "dateUpdated": "2026-01-22T16:16:06.007Z", "dateReserved": "2025-10-27T15:26:14.126Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-22T14:57:00.362Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "nerves_hub_web", "vendor": "nerves-hub", "versions": [{"status": "affected", "version": ">= 1.0.0, < 2.3.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:nerves-hub:nerveshub:*:*:*:*:*:*:*:*", "matchCriteriaId": "646D7D8C-71D2-4E26-AC0A-F3D5D7CA26EA", "versionEndExcluding": "2.3.0", "versionStartIncluding": "1.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation,\nfirewalling access to the NervesHub server can help limit exposure until an upgrade is possible."}, {"lang": "es", "value": "NervesHub es un servicio web que permite a los usuarios gestionar actualizaciones de firmware por aire (OTA) de dispositivos en campo. Una vulnerabilidad presente a partir de la versi\u00f3n 1.0.0 y anterior a la versi\u00f3n 2.3.0 permit\u00eda a los atacantes forzar por fuerza bruta tokens de API de usuario debido al formato predecible de los tokens emitidos previamente. Los tokens inclu\u00edan componentes identificables por el usuario y no eran criptogr\u00e1ficamente seguros, haci\u00e9ndolos susceptibles a la adivinaci\u00f3n o enumeraci\u00f3n. La vulnerabilidad podr\u00eda haber permitido acceso no autorizado a cuentas de usuario o acciones de API protegidas por estos tokens. Una soluci\u00f3n est\u00e1 disponible en la versi\u00f3n 2.3.0 de NervesHub. Esta versi\u00f3n introduce tokens fuertes y criptogr\u00e1ficamente aleatorios usando ':crypto.strong_rand_bytes/1', el hash de los tokens antes del almacenamiento en la base de datos para prevenir el uso indebido incluso si la base de datos est\u00e1 comprometida, y almacenamiento de tokens consciente del contexto para distinguir entre tokens de sesi\u00f3n y de API. No hay soluciones alternativas pr\u00e1cticas para este problema aparte de la actualizaci\u00f3n. En entornos sensibles, como una mitigaci\u00f3n temporal, el acceso con firewall al servidor de NervesHub puede ayudar a limitar la exposici\u00f3n hasta que sea posible una actualizaci\u00f3n."}], "id": "CVE-2025-64097", "lastModified": "2026-06-17T09:53:49.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64097", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-01-22T16:15:56.743700Z", "version": "2.0.3"}}]}, "published": "2026-01-22T15:16:48.223", "references": [{"source": "security-advisories@github.com", "tags": ["Issue Tracking", "Patch"], "url": "https://github.com/nerves-hub/nerves_hub_web/pull/2024"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-330"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2026-01-23T16:32:27.127294+00:00", "updated": "2026-01-23T16:32:27.127321+00:00", "vendors": ["nerves-hub", "nerves-hub$PRODUCT$nerves_hub_web"]}