CVE-2025-54471CWE-321

CVE-2025-54471

Medium · published October 30, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
17.9
In the wild
Unconfirmed
What it is

NeuVector used a hard-coded cryptographic key embedded in the source

code. At compilation time, the key value was replaced with the secret

key value and used to encrypt sensitive configurations when NeuVector

stores the data.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00268 · 17.9th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2025-10-30T14:15Z
References (2)
https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-54471 · [email protected]https://github.com/neuvector/neuvector/security/advisories/GHSA-h773-7gf7-9m2x · [email protected]
EPSS history
Timeline
  • 30 OCT 09:45Z
    NeuVector is shipping cryptographic material into its binary
    cvelistv5