« Volver al listado

CVE-2025-67860

Estado: AplazadaBaja (3.8)—

A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Neuvector — ScannerAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-67860",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-67860",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-02-25T21:03:42.616109Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "meissner@suse.de",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 3.8,
          "attackVector": "LOCAL",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2
      }
    ]
  },
  "affected": [
    {
      "source": "meissner@suse.de",
      "affectedData": [
        {
          "vendor": "SUSE",
          "product": "harvester",
          "versions": [
            {
              "status": "affected",
              "version": "4.0",
              "lessThan": "4.072",
              "versionType": "semver"
            }
          ],
          "packageName": "github.com/neuvector/scanner",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-02-25T11:16:02.820",
  "references": [
    {
      "url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2025-67860",
      "source": "meissner@suse.de"
    },
    {
      "url": "https://github.com/harvester/harvester/security/advisories/GHSA-3c9m-gq32-g4jx",
      "source": "meissner@suse.de"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "meissner@suse.de",
      "description": [
        {
          "lang": "en",
          "value": "CWE-522"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been identified in the NeuVector scanner where the scanner process accepts registry and controller credentials as command-line arguments, potentially exposing sensitive credentials to local users."
    },
    {
      "lang": "es",
      "value": "Una vulnerabilidad ha sido identificada en el escáner NeuVector donde el proceso del escáner acepta credenciales de registro y de controlador como argumentos de línea de comandos, exponiendo potencialmente credenciales sensibles a usuarios locales."
    }
  ],
  "lastModified": "2026-06-17T09:58:12.100",
  "sourceIdentifier": "meissner@suse.de"
}