Threat Intelligence Database

CVE-2025-66001 is a high-severity vulnerability in SUSE NeuVector version 5.3.0 where TLS verification for OpenID Connect login authentication is not enforced by default. This improper certificate validation (CWE-295) allows attackers to perform man-in-the-middle (MITM) attacks, potentially compromising confidentiality, integrity, and availability of the system. Exploitation requires no privileges but does require user interaction during login. The vulnerability has a CVSS score of 8.8, indicating a high impact with network attack vector and low attack complexity. No known exploits are currently reported in the wild. European organizations using NeuVector 5.3.

HighVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-66001#cwe-295

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

MediumVulnerabilityGermanyFranceNetherlands+3#cve#cve-2025-54471#cwe-321

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

CriticalVulnerabilityUnited StatesGermanyJapan+7#cve#cve-2025-54469#cwe-78

CVE-2025-54470 is a high-severity vulnerability in SUSE NeuVector versions 5.3.0 and 5.4.0 that occurs when the 'Report anonymous cluster data' option is enabled. NeuVector fails to enforce TLS certificate validation when sending anonymous telemetry data, exposing the communication to man-in-the-middle attacks. Additionally, the telemetry server's response is loaded into memory without size limitation, allowing potential denial of service attacks.