NeuVector Enforcer Command Injection via Unsanitized CLUSTER_* Ports
CVE-2025-54469 Published on October 30, 2025
NeuVector Enforcer is vulnerable to Command Injection and Buffer overflow
A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.
The entry process of the enforcer container is the monitor
process. When the enforcer container stops, the monitor process checks
whether the consul subprocess has exited. To perform this check, the
monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.
The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT
are used directly to compose shell commands via popen without
validation or sanitization. This behavior could allow a malicious user
to inject malicious commands through these variables within the enforcer
container.
Vulnerability Analysis
CVE-2025-54469 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Type
What is a Shell injection Vulnerability?
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVE-2025-54469 has been classified to as a Shell injection vulnerability or weakness.
Products Associated with CVE-2025-54469
Want to know whenever a new CVE is published for Suse Neuvector? stack.watch will email you.
Affected Versions
SUSE neuvector:- Version 5.3.0 and below 5.3.5 is affected.
- Version 5.4.0 and below 5.4.7 is affected.
- Version 0.0.0-20230727023453-1c4957d53911 and below 0.0.0-20251020133207-084a437033b4 is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.