PT-2025-33862 · Unknown · Nginx-Defender

Anipaleja · Published 2025-08-19 · Updated 2025-08-29 · CVE-2025-55740

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: nginx-defender versions prior to 1.5.0

Description: nginx-defender deployments are susceptible to a configuration issue due to the presence of default credentials in example configuration files, such as config.yaml and docker-compose.yml. These default credentials include default password: "change me please" and GF SECURITY ADMIN PASSWORD=admin123. If these defaults are not changed during deployment, attackers with network access could gain administrative control, potentially bypassing security protections.

Recommendations: Update to version 1.5.0 or later. Change the default credentials in config.yaml and docker-compose.yml immediately. Specifically, update default password and GF SECURITY ADMIN PASSWORD.

Exploit

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2025-55740

GHSA-PR72-8FXW-XX22

GO-2025-3896

Affected Products

Nginx-Defender

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55740.json · Exploit
• https://osv.dev/vulnerability/GHSA-pr72-8fxw-xx22 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3896 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-55740 · Security Note
• https://osv.dev/vulnerability/CVE-2025-55740 · Vendor Advisory
• https://github.com/Anipaleja/nginx-defender/security/advisories/GHSA-pr72-8fxw-xx22 · Note
• https://github.com/Anipaleja/nginx-defender · Note
• https://twitter.com/CVEnew/status/1957899799883304997 · Twitter Post
• https://pkg.go.dev/vuln/GO-2025-3896 · Note
• https://twitter.com/VulmonFeeds/status/1958079385518420048 · Twitter Post