PT-2025-35110 · Neuvector · Neuvector

Binx-Suse · Published 2025-08-28 · Updated 2025-09-22 · CVE-2025-53884

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: NeuVector versions 5.0.0 through 5.4.5

Description: NeuVector stores user passwords and API keys using a simple, unsalted hash, making it vulnerable to rainbow table attacks. The software generates a cryptographically secure, random 16-character salt and uses it with the PBKDF2 algorithm when creating a user, updating a user’s password, or creating an API key. After upgrading to NeuVector 5.4.6, users must log in again to regenerate the password hash, and at least one request per API key must be sent to regenerate its hash value.

Recommendations: Upgrade to NeuVector version 5.4.6 or later.

Fix

Weakness Enumeration

CWE-759

CWE-916

Related Identifiers

CVE-2025-53884

GHSA-8FF6-PC43-JWV3

GO-2025-3917

OPENSUSE-SU-2025:15538-1

SUSE-SU-2025:03289-1

Affected Products

Neuvector

References · 48

• https://osv.dev/vulnerability/SUSE-SU-2025:03289-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15538-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-53884 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8ff6-pc43-jwv3 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3917 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53884 · Security Note
• https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3 · Note
• https://github.com/neuvector/neuvector · Note
• https://suse.com/security/cve/CVE-2025-9076 · Note
• https://suse.com/security/cve/CVE-2025-8077 · Note
• https://suse.com/security/cve/CVE-2024-58259 · Note
• https://suse.com/security/cve/CVE-2025-51667 · Note
• https://t.me/CVEtracker/32748 · Telegram Post
• https://twitter.com/CVEnew/status/1968349170579968495 · Twitter Post
• https://suse.com/security/cve/CVE-2025-54376 · Note