cve.bz

CVE-2025-54471

6.5 mediumEPSS 0.3%

NeuVector used a hard-coded cryptographic key embedded in the source code. At compilation time, the key value was replaced with the secret key value and used to encrypt sensitive configurations when NeuVector stores the data.

CVSS 3.1
6.5CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS
0.3% chance of exploitation in the next 30 days; higher than 18% of CVEs (scores of 2026-10-25)
CWE
CWE-321
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-h773-7gf7-9m2xGogithub.com/neuvector/neuvector>=5.3.0 <5.4.75.4.7
GHSA-h773-7gf7-9m2xGogithub.com/neuvector/neuvector>=0.0.0-20230727023453-1c4957d53911 <0.0.0-20251020133207-084a437033b40.0.0-20251020133207-084a437033b4
GO-2025-4043Gogithub.com/neuvector/neuvector>=0.0.0-20230727023453-1c4957d53911 <0.0.0-20251020133207-084a437033b40.0.0-20251020133207-084a437033b4

References

Check your stackJSON