Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2025-64097— NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force

Quick assessment

Affected
nerves-hub nerves_hub_web
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NervesHub是NervesHub开源的一个管理Nerves设备的固件更新的软件。 NervesHub 1.0.0版本至2.3.0之前版本存在安全特征问题漏洞，该漏洞源于令牌格式可预测且非加密安全，可能导致暴力破解用户API令牌，造成未授权访问。

AI Predicted 8.6 Difficulty: Easy EPSS 0.44% · P36

Possible ATT&CK Techniques 1 AI

T1110.003 · Password Spraying
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-64097

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
NervesHub has Insufficient Token Entropy that Allows Authentication Bypass via Brute Force
Source: CVE Program / CVE List V5
Vulnerability Description
NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation, firewalling access to the NervesHub server can help limit exposure until an upgrade is possible.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用不充分的随机数
Source: CVE Program / CVE List V5
Vulnerability Title
NervesHub 安全特征问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
NervesHub是NervesHub开源的一个管理Nerves设备的固件更新的软件。 NervesHub 1.0.0版本至2.3.0之前版本存在安全特征问题漏洞，该漏洞源于令牌格式可预测且非加密安全，可能导致暴力破解用户API令牌，造成未授权访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
nerves-hub nerves_hub_web >= 1.0.0, < 2.3.0 -

II. Public POCs for CVE-2025-64097

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-64097

请登录查看更多情报信息。

Vendor Advisories for CVE-2025-64097 (1)

IV. Related Vulnerabilities

Same product: nerves_hub_web
Same vendor: nerves-hub
Same weakness: CWE-330

V. Comments for CVE-2025-64097

No comments yet

Leave a comment