PT-2025-31757 · Fireedge+1 · Fireedge+2

Alex Perrakis + 1 · Published 2025-08-02 · Updated 2025-08-04 · CVE-2025-54955

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenNebula Community Edition (CE) versions prior to 7.0.0 OpenNebula Enterprise Edition (EE) versions prior to 6.10.3

Description A critical race condition exists in FireEdge that can lead to full account takeover. An unauthenticated attacker can obtain a valid JSON Web Token (JWT) belonging to a legitimate user without knowing their credentials. A JWT is a compact, URL-safe means of representing claims to be transferred between two parties.

Recommendations Update OpenNebula Community Edition (CE) to version 7.0.0 or later. Update OpenNebula Enterprise Edition (EE) to version 6.10.3 or later.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2025-54955

Affected Products

Fireedge

Opennebula Community Edition

Opennebula Enterprise Edition

References · 14

• 🔥 https://github.com/Stolichnayer/OpenNebula-Account-Takeover · Exploit
• https://osv.dev/vulnerability/CVE-2025-54955 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54955 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-54955 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-54955 · Security Note
• https://ubuntu.com/security/CVE-2025-54955 · Vendor Advisory
• https://github.com/OpenNebula/one/releases/tag/release-7.0.0 · Note
• https://github.com/OpenNebula/one · Note
• https://github.com/OpenNebula/one/commit/81058d9705e7ac619d294423de28b76d88f613b6 · Note
• https://twitter.com/CVEnew/status/1951793924378653179 · Twitter Post
• https://docs.opennebula.io/6.10/intro_release_notes/release_notes_enterprise/resolved_issues_6103.html · Note
• https://t.me/cveNotify/130689 · Telegram Post
• https://t.me/cveNotify/130803 · Telegram Post
• https://t.me/CVEtracker/29038 · Telegram Post