CVE-2025-8077

{
  "id": "CVE-2025-8077",
  "sourceIdentifier": "[email protected]",
  "published": "2025-09-17T13:15:34.460",
  "lastModified": "2026-10-18T21:10:00.120",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad en las versiones de NeuVector hasta e incluyendo la 5.4.5, donde se utiliza una cadena fija como contraseña predeterminada para la cuenta 'admin' integrada. Si esta contraseña no se cambia inmediatamente después del despliegue, cualquier carga de trabajo con acceso de red dentro del clúster podría usar las credenciales predeterminadas para obtener un token de autenticación. Este token puede entonces ser utilizado para realizar cualquier operación a través de las API de NeuVector."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "neuvector",
          "defaultStatus": "unaffected",
          "packageName": "github.com/neuvector/neuvector",
          "versions": [
            {
              "version": "5.0.0",
              "lessThan": "5.4.6",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2025-09-18T03:55:13.022800Z",
          "id": "CVE-2025-8077",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1393"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56",
      "source": "[email protected]"
    }
  ]
}