CVE-2025-8077: falha crítica em SUSE neuvector
NeuVector admin account has insecure default password
Publicada em · Atualizada em
28Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 9.8epss 0.6%
probabilidade de exploração
0.6%top 54% das CVEs
exploração observada
nãonenhuma fonte reporta
A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
SUSE · neuvectorCVEs relacionadas — SUSE neuvector
No mesmo produto, das mais perigosas para as menos.
CVE-2023-32188CRITICALJWT token compromise can allow malicious actions including Remote Code Execution (RCE)EPSS 0.6%CVE-2025-54469CRITICALNeuVector Enforcer is vulnerable to Command Injection and Buffer overflowEPSS 0.5%CVE-2023-22644CRITICALJWT token compromise can allow malicious actions including Remote Code Execution (RCE)EPSS 0.5%CVE-2025-66001HIGHNeuVector OpenID Connect is vulnerable to man-in-the-middle (MITM)EPSS 0.4%CVE-2025-46808MEDIUMSensitive information is leaked into NeuVector’s manager container logsEPSS 0.3%CVE-2025-54471MEDIUMNeuVector is shipping cryptographic material into its binaryEPSS 0.3%