by Kastro
Paper/Archive/CVE-2025-8077

CVE-2025-8077

SUSE neuvector — NeuVector admin account has insecure default password

EPSS 0.6%CVSS 9.8
critical.is priorityof 100
39
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 46.5.465 × 209.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A vulnerability exists in NeuVector versions up to and including 5.4.5, where a fixed string is used as the default password for the built-in `admin` account. If this password is not changed immediately after deployment, any workload with network access within the cluster could use the default credentials to obtain an authentication token. This token can then be used to perform any operation via NeuVector APIs.

Affected

ProductAffectedFixed inSource
neuvector5.0.0 – < 5.4.65.4.6CNA

Scores by source

suse (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refbugzilla.suse.com/show_bug.cgi?id=CVE-2025-8077refgithub.com/neuvector/neuvector/security/advisories/GHSA-8pxw-9c75-6w56