PT-2025-43269 · Neuvector · Neuvector

Published 2025-10-21 · Updated 2025-11-07 · CVE-2025-54470

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Name of the Vulnerable Software and Affected Versions NeuVector versions prior to 5.4.7

Description NeuVector deployments are affected when the Report anonymous cluster data option is enabled. Without TLS certificate verification, the communication channel to the telemetry server at https://upgrades.neuvector-upgrade-responder.livestock.rancher.io is susceptible to man-in-the-middle (MITM) attacks, potentially allowing an attacker to intercept or modify data. Additionally, NeuVector loads the telemetry server’s response into memory without a size limitation, creating a potential Denial of Service (DoS) attack vector. The telemetry server’s TLS certificate chain and hostname are not verified during the handshake process.

Recommendations Versions prior to 5.4.7 should be updated to version 5.4.7 or later. As a temporary workaround, disable the Report anonymous cluster data option in the NeuVector UI under Settings -> Configuration -> Report anonymous cluster data.

Fix

DoS

Allocation of Resources Without Limits

Improper Certificate Validation

Weakness Enumeration

CWE-770

CWE-295

Related Identifiers

CVE-2025-54470

GHSA-QQJ3-G7MX-5P4W

GO-2025-4044

OPENSUSE-SU-2025:15710-1

Affected Products

Neuvector

References · 84

• https://osv.dev/vulnerability/openSUSE-SU-2025:15710-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4044 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-qqj3-g7mx-5p4w · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54470 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54470 · Security Note
• https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w · Note
• https://github.com/neuvector/neuvector · Note
• https://github.com/neuvector/neuvector/commit/415737cbec581a5dc5f204fac1c78b7f29ad7dc2 · Note
• https://github.com/neuvector/neuvector/commit/06424701e69bf1eb76ff90180d78853fded93021 · Note
• https://suse.com/security/cve/CVE-2016-11067 · Note
• https://suse.com/security/cve/CVE-2025-58073 · Note
• https://suse.com/security/cve/CVE-2016-11078 · Note
• https://suse.com/security/cve/CVE-2025-59043 · Note
• https://suse.com/security/cve/CVE-2025-11375 · Note
• https://suse.com/security/cve/CVE-2025-54471 · Note