CVE-2025-54469: suse neuvector OS Command Injection

Vulnerability summary

CVE-2025-54469 is a critical (CVSS 9.9) OS Command Injection vulnerability in suse neuvector. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.3% of scored vulnerabilities.

Timeline

1. 30-10-2025
   PublishedVulnerability first disclosed.
2. 26-02-2026
   Last modifiedVulnerability information updated.

Description

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values. The entry process of the enforcer container is the monitor process. When the enforcer container stops, the monitor process checks whether the consul subprocess has exited. To perform this check, the monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active. The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT are used directly to compose shell commands via popen without validation or sanitization. This behavior could allow a malicious user to inject malicious commands through these variables within the enforcer container.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.