CVE-2025-53884— NeuVector has an insecure password storage vulnerable to rainbow attack
Quick assessment
Affected
SUSE neuvector
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NeuVector是美国NeuVector公司的一套端到端的容器安全平台。该平台包括图像漏洞管理、准入控制和容器进程/文件系统保护等功能。 NeuVector存在安全漏洞，该漏洞源于使用简单且未加盐的哈希存储用户密码和API密钥，容易受到彩虹表攻击。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-53884
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NeuVector has an insecure password storage vulnerable to rainbow attack
Source: CVE Program / CVE List V5
Vulnerability Description
NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用未加Salt的单向哈希算法
Source: CVE Program / CVE List V5
Vulnerability Title
NeuVector 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NeuVector是美国NeuVector公司的一套端到端的容器安全平台。该平台包括图像漏洞管理、准入控制和容器进程/文件系统保护等功能。 NeuVector存在安全漏洞，该漏洞源于使用简单且未加盐的哈希存储用户密码和API密钥，容易受到彩虹表攻击。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-53884
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-53884
请登录查看更多情报信息。
Same Patch Batch · SUSE · 2025-09-17 · 3 CVEs total
| CVE-2025-8077 | 9.8 CRITICAL | NeuVector admin account has insecure default password |
| CVE-2025-54467 | 5.3 MEDIUM | NeuVector process with sensitive arguments lead to leakage |
IV. Related Vulnerabilities
Same product: neuvector
-
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle -
CVE-2025-54471
NeuVector is shipping cryptographic material into its binary -
CVE-2025-54469
NeuVector Enforcer is vulnerable to Command Injection and Bu -
CVE-2025-54470
NeuVector telemetry sender is vulnerable to MITM and DoS
Same vendor: SUSE
-
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala -
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2026-55998
Cluster Existence Oracle via Unauthenticated Import Endpoint -
CVE-2026-59675
Rancher Audit-Log Middleware Unauthenticated Memory Exhausti -
CVE-2026-55996
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Ra
Same weakness: CWE-759
-
CVE-2026-57263
Siemens LOGO! Soft Comfort 加密问题漏洞 -
CVE-2025-15631
Weak Credential Storage in TP-Link Omada Devices -
CVE-2025-15544
Weak Credential Protection During TP-Link Omada Device Adopt -
CVE-2026-45027
WeGIA: Use of Weak Password Hashing Algorithm (SHA-256, no s -
CVE-2025-36253
Multiple Vulnerabilities in IBM Concert Software.
V. Comments for CVE-2025-53884
No comments yet