CVE-2025-64097
Predictable API Token Brute-Force Vulnerability in NervesHub
Publication date: 2026-01-22
Last updated on: 2026-02-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| nerves-hub | nerveshub | From 1.0.0 (inc) to 2.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-330 | The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-64097 is a critical vulnerability in NervesHub where user API tokens were generated with a predictable format containing user-identifiable components and lacked cryptographic randomness. This made the tokens susceptible to brute-force attacks, allowing attackers to guess or enumerate tokens and potentially gain unauthorized access to user accounts or API actions. The vulnerability existed in versions from 1.0.0 up to but not including 2.3.0. The fix in version 2.3.0 introduced strong cryptographically-random tokens, hashing of tokens before database storage, and context-aware token storage to improve security. [1, 3]
How can this vulnerability impact me? :
This vulnerability can allow attackers to brute-force user API tokens and gain unauthorized access to user accounts or perform API actions protected by these tokens. This compromises the confidentiality and integrity of the system, potentially allowing attackers to manage firmware updates or device deployments without permission. Exploitation requires network access and knowledge of token generation timing but no privileges or user interaction. Most users behind VPNs or similar protections are less likely to be affected. However, if exploited, it could lead to significant unauthorized control over devices managed by NervesHub. [1, 3]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
Detection of this vulnerability involves identifying the use of predictable, non-cryptographically secure API tokens issued by NervesHub versions prior to 2.3.0. Since tokens include user-identifiable components and are susceptible to brute-force attacks, monitoring for repeated failed authentication attempts or unusual API token usage patterns could indicate exploitation attempts. However, no specific detection commands or tools are provided in the resources. Network monitoring for brute-force attempts against the NervesHub API endpoints and checking the version of NervesHub deployed (versions before 2.3.0 are vulnerable) are recommended. Additionally, verifying if the tokens in use are the old predictable format versus the new cryptographically secure tokens could help detect vulnerability presence. [1, 3]
What immediate steps should I take to mitigate this vulnerability?
The immediate and primary mitigation step is to upgrade NervesHub to version 2.3.0 or later, which fixes the vulnerability by introducing cryptographically secure token generation, token hashing before database storage, and context-aware token management. If upgrading immediately is not possible, a temporary mitigation is to firewall access to the NervesHub server to limit exposure to potential brute-force attacks. There are no practical workarounds other than upgrading. Additionally, monitoring and rotating tokens after upgrade is recommended to invalidate any potentially compromised tokens. [1, 3]
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not explicitly discuss the impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA. However, since the vulnerability allows unauthorized access to user accounts and API actions due to predictable and insecure tokens, it could potentially lead to unauthorized data access or breaches, which may affect compliance with data protection regulations. No direct statements or analysis regarding compliance impact are given. [1, 3]