CVE-2025-10678

NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL. This issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed. This issue has been fixed in version 0.57.0

CVSS

No CVSS.

References

Link	Resource
https://cert.pl/en/posts/2025/10/CVE-2025-10678
https://netbird.io/

Configurations

No configuration.

History

19 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) NetBird VPN, cuando se instaló usando el script proporcionado por el proveedor, no pudo eliminar o cambiar la contraseña predeterminada de una cuenta de administrador creada por ZITADEL. Este problema afecta a las instancias instaladas usando el script proporcionado por el proveedor. Este problema puede afectar a las instancias creadas con Docker si la contraseña predeterminada no se cambió ni se eliminó al usuario. Este problema se ha solucionado en la versión 0.57.0.

Information

Published : 2025-10-20 16:15

Updated : 2026-10-19 16:10

NVD link : CVE-2025-10678

Mitre link : CVE-2025-10678

CVE.ORG link : CVE-2025-10678

JSON object : View

Products Affected

No product.

CWE

CWE-1392

Use of Default Credentials

{"id": "CVE-2025-10678", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10678", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T15:52:06.861232Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cvd@cert.pl", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cvd@cert.pl", "affectedData": [{"vendor": "NetBird VPN", "product": "NetBird", "versions": [{"status": "affected", "version": "0", "lessThan": "0.57.0", "versionType": "semver"}], "packageName": "netbird", "collectionURL": "https://github.com", "defaultStatus": "unaffected"}]}], "published": "2025-10-20T16:15:36.477", "references": [{"url": "https://cert.pl/en/posts/2025/10/CVE-2025-10678", "source": "cvd@cert.pl"}, {"url": "https://netbird.io/", "source": "cvd@cert.pl"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cvd@cert.pl", "description": [{"lang": "en", "value": "CWE-1392"}]}], "descriptions": [{"lang": "en", "value": "NetBird VPN when installed using vendor's provided script failed to remove or change default password of an admin account created by ZITADEL.\nThis issue affects instances installed using vendor's provided script. This issue may affect instances created with Docker if the default password was not changed nor the user was removed.\n\nThis issue has been fixed in version 0.57.0"}, {"lang": "es", "value": "NetBird VPN, cuando se instal\u00f3 usando el script proporcionado por el proveedor, no pudo eliminar o cambiar la contrase\u00f1a predeterminada de una cuenta de administrador creada por ZITADEL.\nEste problema afecta a las instancias instaladas usando el script proporcionado por el proveedor. Este problema puede afectar a las instancias creadas con Docker si la contrase\u00f1a predeterminada no se cambi\u00f3 ni se elimin\u00f3 al usuario.\n\nEste problema se ha solucionado en la versi\u00f3n 0.57.0."}], "lastModified": "2026-10-19T16:10:00.260", "sourceIdentifier": "cvd@cert.pl"}