VulnerabilityDeferred

CVE-2025-54471

NeuVector used a hard-coded cryptographic key embedded in the source code.

MEDIUM 6.5EPSS 0.25%

Does this matter?

Lower severity and a low EPSS score (0.25%). Track it; it rarely justifies an emergency change on its own.

Description

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS: 0.25% probability · 16th percentile
CISA KEV: Not listed
Weakness: CWE-321
Source: meissner@suse.de

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471
https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.