CVE-2025-54469
published 2025-10-30CVE-2025-54469: A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be…
PriorityP263critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.43%
34.4th percentile
A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.
The entry process of the enforcer container is the monitor
process. When the enforcer container stops, the monitor process checks
whether the consul subprocess has exited. To perform this check, the
monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.
The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT
are used directly to compose shell commands via popen without
validation or sanitization. This behavior could allow a malicious user
to inject malicious commands through these variables within the enforcer
container.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | neuvector_neuvector | >= 0.0.0-20230727023453-1c4957d53911 < 0.0.0-20251020133207-084a437033b4 | 0.0.0-20251020133207-084a437033b4 |
| github.com | neuvector_neuvector | >= 5.3.0 < 5.3.5 | 5.3.5 |
| github.com | neuvector_neuvector | >= 5.4.0 < 5.4.7 | 5.4.7 |
| suse | neuvector | >= 0.0.0-20230727023453-1c4957d53911 < 0.0.0-20251020133207-084a437033b4 | 0.0.0-20251020133207-084a437033b4 |
| suse | neuvector | >= 5.3.0 < 5.3.5 | 5.3.5 |
| suse | neuvector | >= 5.4.0 < 5.4.7 | 5.4.7 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector
osv·2025-10-30
CVE-2025-54469 NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow in github.com/neuvector/neuvector.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: github.com/neuvector/neuvector from v5.3.0 before v5.3.5, from v5.4.0 before v5.4.7.
GHSA
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
ghsa·2025-10-21
CVE-2025-54469 [CRITICAL] CWE-120 NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
### Impact
A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.
The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.
The values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without
OSV
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
osv·2025-10-21
CVE-2025-54469 [CRITICAL] NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
### Impact
A vulnerability was identified in NeuVector, where the enforcer used environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` to generate a command to be executed via `popen`, without first sanitising their values.
The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the `popen` function to execute a shell command that determines whether the ports used by the consul subprocess are still active.
The values of environment variables `CLUSTER_RPC_PORT` and `CLUSTER_LAN_PORT` are used directly to compose shell commands via popen without
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-10-30
Published