CVE-2025-54469

/// Technical description

A vulnerability was identified in NeuVector, where the enforcer used environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT to generate a command to be executed via popen, without first sanitising their values.

The entry process of the enforcer container is the monitor

process. When the enforcer container stops, the monitor process checks

whether the consul subprocess has exited. To perform this check, the

monitor process uses the popen function to execute a shell command that determines whether the ports used by the consul subprocess are still active.

The values of environment variables CLUSTER_RPC_PORT and CLUSTER_LAN_PORT

are used directly to compose shell commands via popen without

validation or sanitization. This behavior could allow a malicious user

to inject malicious commands through these variables within the enforcer

container.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References