Read the docs
TI-2025-34264 Aliases CVE-2025-54467GHSA-w54x-xfxg-4gxq

NeuVector process with sensitive arguments lead to leakage

Priority LOW 30CWE-522Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-522.

Summary

When a Java command with password parameters is executed and terminated by NeuVector for Process rule violation the password will appear in the NeuVector security event log.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0025 16th percentileScored 2026-11-07
Fix Fixed neuvector (SUSE): 5.4.6github.com/neuvector/neuvector (Go): 0.0.0-20250902144615-f9ddbdf42031

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSEneuvector5.0.0 to before 5.4.65.4.6Patch availableCNA
—github.com/neuvector/neuvector (Go)before 0.0.0-20250902144615-f9ddbdf420310.0.0-20250902144615-f9ddbdf42031Patch availableGHSA-w54x-xfxg-4gxq
  • neuvector VendorSUSE Affected 5.0.0 to before 5.4.6 Fixed in 5.4.6 Patch available CNA
  • github.com/neuvector/neuvector (Go) Vendor— Affected before 0.0.0-20250902144615-f9ddbdf42031 Fixed in 0.0.0-20250902144615-f9ddbdf42031 Patch available GHSA-w54x-xfxg-4gxq

Remediation

  • Fix · CNA neuvector (SUSE) Fixed in 5.4.6
  • Fix · GHSA-w54x-xfxg-4gxq github.com/neuvector/neuvector (Go) Fixed in 0.0.0-20250902144615-f9ddbdf42031 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE neuvector 5.4.6

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2025-07390 NeuVector admin account has insecure default passwordPriority MEDIUM 50
    • TI-2025-33759 NeuVector has an insecure password storage vulnerable to rainbow attackPriority LOW 29
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54467
  2. 2026-10-03 Alias added: GHSA-w54x-xfxg-4gxq

References

Advisory 1

Other 4

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences