CVE-2025-54471— NeuVector is shipping cryptographic material into its binary
Quick assessment
Affected
SUSE neuvector
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
NeuVector是美国NeuVector公司的一套端到端的容器安全平台。该平台包括图像漏洞管理、准入控制和容器进程/文件系统保护等功能。 NeuVector存在安全漏洞，该漏洞源于使用了硬编码加密密钥，可能导致敏感配置数据泄露。
Possible ATT&CK Techniques 1 AI
T1416
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-54471
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
NeuVector is shipping cryptographic material into its binary
Source: CVE Program / CVE List V5
Vulnerability Description
NeuVector used a hard-coded cryptographic key embedded in the source
code. At compilation time, the key value was replaced with the secret
key value and used to encrypt sensitive configurations when NeuVector
stores the data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
使用硬编码的密码学密钥
Source: CVE Program / CVE List V5
Vulnerability Title
NeuVector 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NeuVector是美国NeuVector公司的一套端到端的容器安全平台。该平台包括图像漏洞管理、准入控制和容器进程/文件系统保护等功能。 NeuVector存在安全漏洞，该漏洞源于使用了硬编码加密密钥，可能导致敏感配置数据泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-54471
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-54471
请登录查看更多情报信息。
Same Patch Batch · SUSE · 2025-10-30 · 5 CVEs total
| CVE-2025-54469 | 9.9 CRITICAL | NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow |
| CVE-2025-54470 | 8.6 HIGH | NeuVector telemetry sender is vulnerable to MITM and DoS |
| CVE-2025-53880 | susemanager-tftpsync-recv allows arbitrary file creation and deletion due to path traversa | |
| CVE-2025-53883 | spacewalk-java has various XSS issues on search page |
IV. Related Vulnerabilities
Same product: neuvector
-
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2025-66001
NeuVector OpenID Connect is vulnerable to man-in-the-middle -
CVE-2025-54469
NeuVector Enforcer is vulnerable to Command Injection and Bu -
CVE-2025-54470
NeuVector telemetry sender is vulnerable to MITM and DoS -
CVE-2025-8077
NeuVector admin account has insecure default password
Same vendor: SUSE
-
CVE-2026-44945
Cross-Cluster Impersonation Confused-Deputy Privilege Escala -
CVE-2026-25703
Potential information leakage from manager /network/graph AP -
CVE-2026-55998
Cluster Existence Oracle via Unauthenticated Import Endpoint -
CVE-2026-59675
Rancher Audit-Log Middleware Unauthenticated Memory Exhausti -
CVE-2026-55996
Unauthenticated Denial-of-Service via TLS SAN Stuffing in Ra
Same weakness: CWE-321
-
CVE-2026-76258
Use of Hard-coded Cryptographic Key through Companion App Re -
CVE-2026-64887
Airwall - Hardcoded Secrets -
CVE-2026-17468
IBM Documentation Offline is vulnerable to information discl -
CVE-2026-63423
Lenovo Accessories and Display Manager 加密问题漏洞 -
CVE-2026-34635
ColdFusion | Use of Hard-coded Cryptographic Key (CWE-321)
V. Comments for CVE-2025-54471
No comments yet