PT-2026-3943 · Nerves Hub · Nerveshub

Published 2026-01-22 · Updated 2026-02-17 · CVE-2025-64097

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions NervesHub versions 1.0.0 through 2.2.9

Description NervesHub is a web service for managing over-the-air (OTA) firmware updates. A weakness existed where attackers could potentially compromise user API tokens due to their predictable format. These tokens included user-identifiable components and lacked sufficient cryptographic security, making them vulnerable to guessing or enumeration. Successful exploitation could lead to unauthorized access to user accounts and API actions.

Recommendations NervesHub versions prior to 2.3.0 should be upgraded to version 2.3.0 or later. As a temporary mitigation, consider firewalling access to the NervesHub server.

Exploit

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2025-64097

GHSA-M9VJ-776Q-VC8M

Affected Products

Nerveshub

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64097.json · Exploit
• https://github.com/nerves-hub/nerves_hub_web/pull/2024 · Patch
• https://github.com/nerves-hub/nerves_hub_web/security/advisories/GHSA-m9vj-776q-vc8m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64097 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64097 · Vendor Advisory
• https://github.com/nerves-hub/nerves_hub_web/releases/tag/v2.3.0 · Note
• https://twitter.com/CVEnew/status/2014358911428522071 · Twitter Post
• https://t.me/cveNotify/152231 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2014399657573515404 · Twitter Post
• https://twitter.com/0dayPublishing/status/2014355180003733939 · Twitter Post