This vulnerability (CVE-2025-8077) affects NeuVector versions up to and including 5.4.5. The issue arises from the use of a hardcoded default password for the built-in admin account. If the default password remains unchanged post-deployment, an attacker with network access inside the cluster can authenticate using these credentials to obtain an authentication token. This token grants the ability to execute any API operation, effectively allowing full control over NeuVector's security functions. The CVSS 3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker who gains network access within the cluster can use the default admin credentials to obtain an authentication token. This token enables the attacker to perform any operation through NeuVector APIs, potentially leading to full compromise of the container security platform, including unauthorized access, modification, or disruption of security policies and monitoring.

No official patch or fix is currently documented. The primary mitigation is to immediately change the default admin password after deployment to prevent unauthorized access. Administrators should ensure that default credentials are not used in production environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.