CVE-2025-8077

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.

CVSS v3 9.8 CRITICAL

9.8^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077
https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56

Configurations

No configuration.

History

18 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Existe una vulnerabilidad en las versiones de NeuVector hasta e incluyendo la 5.4.5, donde se utiliza una cadena fija como contraseña predeterminada para la cuenta 'admin' integrada. Si esta contraseña no se cambia inmediatamente después del despliegue, cualquier carga de trabajo con acceso de red dentro del clúster podría usar las credenciales predeterminadas para obtener un token de autenticación. Este token puede entonces ser utilizado para realizar cualquier operación a través de las API de NeuVector.

Information

Published : 2025-09-17 13:15

Updated : 2026-10-18 21:10

NVD link : CVE-2025-8077

Mitre link : CVE-2025-8077

CVE.ORG link : CVE-2025-8077

JSON object : View

Products Affected

No product.

CWE

CWE-1393

Use of Default Password

{"id": "CVE-2025-8077", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8077", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-18T03:55:13.022800Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "meissner@suse.de", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "meissner@suse.de", "affectedData": [{"vendor": "SUSE", "product": "neuvector", "versions": [{"status": "affected", "version": "5.0.0", "lessThan": "5.4.6", "versionType": "semver"}], "packageName": "github.com/neuvector/neuvector", "defaultStatus": "unaffected"}]}], "published": "2025-09-17T13:15:34.460", "references": [{"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077", "source": "meissner@suse.de"}, {"url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56", "source": "meissner@suse.de"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "meissner@suse.de", "description": [{"lang": "en", "value": "CWE-1393"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs."}, {"lang": "es", "value": "Existe una vulnerabilidad en las versiones de NeuVector hasta e incluyendo la 5.4.5, donde se utiliza una cadena fija como contrase\u00f1a predeterminada para la cuenta 'admin' integrada. Si esta contrase\u00f1a no se cambia inmediatamente despu\u00e9s del despliegue, cualquier carga de trabajo con acceso de red dentro del cl\u00faster podr\u00eda usar las credenciales predeterminadas para obtener un token de autenticaci\u00f3n. Este token puede entonces ser utilizado para realizar cualquier operaci\u00f3n a trav\u00e9s de las API de NeuVector."}], "lastModified": "2026-10-18T21:10:00.120", "sourceIdentifier": "meissner@suse.de"}