CVE-2025-54469

CWE-78 — OS Command InjectionCWE-120 — Classic Buffer OverflowCWE-77 — Command Injection5 documents4 sources
Severity
9.9CRITICAL
EPSS
0.1%
top 82.74%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse NeuvectorGithub.com Neuvector/neuvector
Timeline
PublishedOct 30

Description

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 3.1 | Impact: 6.0

Affected Packages2 packages

▶CVEListV5suse/neuvector5.3.0 — 5.3.5+2
▶Gogithub.com/neuvector/neuvector5.3.0 — 5.3.5+2

🔴Vulnerability Details

4
CVEList
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow↗2025-10-30
▶
OSV
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector↗2025-10-30
▶
GHSA
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow↗2025-10-21
▶
OSV
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow↗2025-10-21
▶
CVE-2025-54469 (CRITICAL CVSS 9.9) | A vulnerability was identified in N | cvebase.io