Read the docs
TI-2025-34266 Aliases CVE-2025-54469GHSA-c8g6-qrwh-m3vp

NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow

Priority MEDIUM 43CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00471 41st percentileScored 2026-11-07
Fix Fixed neuvector (SUSE): 5.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4github.com/neuvector/neuvector (Go): 5.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SUSEneuvector5.3.0 to before 5.3.5; 5.4.0 to before 5.4.7; 0.0.0-20230727023453-1c4957d53911 to before 0.0.0-20251020133207-084a437033b45.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4Patch availableCNA
—github.com/neuvector/neuvector (Go)5.3.0 to before 5.3.55.3.5Patch availableGHSA-c8g6-qrwh-m3vp
—github.com/neuvector/neuvector (Go)5.4.0 to before 5.4.75.4.7Patch availableGHSA-c8g6-qrwh-m3vp
—github.com/neuvector/neuvector (Go)0.0.0-20230727023453-1c4957d53911 to before 0.0.0-20251020133207-084a437033b40.0.0-20251020133207-084a437033b4Patch availableGHSA-c8g6-qrwh-m3vp
  • neuvector VendorSUSE Affected 5.3.0 to before 5.3.5; 5.4.0 to before 5.4.7; 0.0.0-20230727023453-1c4957d53911 to before 0.0.0-20251020133207-084a437033b4 Fixed in 5.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4 Patch available CNA
  • github.com/neuvector/neuvector (Go) Vendor— Affected 5.3.0 to before 5.3.5 Fixed in 5.3.5 Patch available GHSA-c8g6-qrwh-m3vp
  • github.com/neuvector/neuvector (Go) Vendor— Affected 5.4.0 to before 5.4.7 Fixed in 5.4.7 Patch available GHSA-c8g6-qrwh-m3vp
  • github.com/neuvector/neuvector (Go) Vendor— Affected 0.0.0-20230727023453-1c4957d53911 to before 0.0.0-20251020133207-084a437033b4 Fixed in 0.0.0-20251020133207-084a437033b4 Patch available GHSA-c8g6-qrwh-m3vp

Remediation

  • Fix · CNA neuvector (SUSE) Fixed in 5.3.5, 5.4.7, 0.0.0-20251020133207-084a437033b4
  • Fix · GHSA-c8g6-qrwh-m3vp github.com/neuvector/neuvector (Go) Fixed in 5.3.5 Advisory →
  • Fix · GHSA-c8g6-qrwh-m3vp github.com/neuvector/neuvector (Go) Fixed in 5.4.7 Advisory →
  • Fix · GHSA-c8g6-qrwh-m3vp github.com/neuvector/neuvector (Go) Fixed in 0.0.0-20251020133207-084a437033b4 Advisory →

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    SUSE neuvector 0.0.0-20251020133207-084a437033b4, 5.3.5, 5.4.7

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2025-34267 NeuVector telemetry sender is vulnerable to MITM and DoSPriority MEDIUM 43
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54469
  2. 2026-10-03 Alias added: GHSA-c8g6-qrwh-m3vp

References

Advisory 1

Other 3

  • TI-2016-03560 Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-03506 Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary… KEVCVSS 3.1CRITICAL 9.8
  • TI-2016-02888 Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04302 Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04301 Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
  • TI-2015-04298 Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3)… KEVCVSS 3.1CRITICAL 9.8
See all 1331 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences