SecuriTricks - CVE-2025-54470

Description

This vulnerability affects NeuVector deployments only when the Report anonymous cluster data option is enabled. When this option is enabled, NeuVector sends anonymous telemetry data to the telemetry server. In affected versions, NeuVector does not enforce TLS certificate verification when transmitting anonymous cluster data to the telemetry server. As a result, the communication channel is susceptible to man-in-the-middle (MITM) attacks, where an attacker could intercept or modify the transmitted data. Additionally, NeuVector loads the response of the telemetry server is loaded into memory without size limitation, which makes it vulnerable to a Denial of Service(DoS) attack

Product(s) Impacted

Vendor	Product	Versions
Neuvector	Neuvector	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	neuvector	neuvector	/	/	/	/	/	/	/	/

References

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54470

https://github.com/neuvector/neuvector/security/advisories/GHSA-qqj3-g7mx-5p4w

CVSS Score

8.6 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: LOW
Integrity Impact: LOW
Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

View Vector String

Timeline

Published: Oct. 30, 2025, 10:15 a.m.
Last Modified: Oct. 30, 2025, 3:03 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

meissner@suse.de

CVE-2025-54470