« Back to list

CVE-2025-53884

Status: DeferredMedium (5.3)—

NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed).

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Neuvector — NeuvectorAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-53884",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53884",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-09-17T13:23:56.456330Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "neuvector",
          "versions": [
            {
              "status": "affected",
              "version": "5.0.0",
              "lessThan": "5.4.6",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/neuvector/neuvector",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-09-17T13:15:33.830",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-53884",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://github.com/neuvector/neuvector/security/advisories/GHSA-8ff6-pc43-jwv3",
      "source": "meissner@suse.de"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-759"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "NeuVector stores user passwords and API keys using a simple, unsalted hash. This method is vulnerable to rainbow table attack (offline attack where hashes of known passwords are precomputed)."
    },
    {
      "lang": "es",
      "value": "NeuVector almacena las contraseñas de usuario y las claves de API utilizando un hash simple y sin hash. Este método es vulnerable a ataques de tabla arcoíris (un ataque fuera de línea donde los hashes de contraseñas conocidas se precalculan)."
    }
  ],
  "lastModified": "2026-06-17T09:39:04.293",
  "sourceIdentifier": "meissner@suse.de"
}