CVE-2025-53884

Sept. 17, 2025, 2:18 p.m.

5.3
Medium

Description

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

Product(s) Impacted

Vendor Product Versions
Neuvector
  • Neuvector
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-759
Use of a One-Way Hash without a Salt
The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a neuvector neuvector / / / / / / / /

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53884
https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3

Tags

meissner@suse.de
CWE-759
2025-09-17
CVE-2025-53884

CVSS Score

5.3 / 10

CVSS Data - 3.1

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Privileges Required: NONE
  • Scope: UNCHANGED
  • Confidentiality Impact: LOW
  • Integrity Impact: NONE
  • Availability Impact: NONE

    • CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

    View Vector String

Timeline

Published: Sept. 17, 2025, 1:15 p.m.
Last Modified: Sept. 17, 2025, 2:18 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

meissner@suse.de

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.