Brute Force Vulnerability in NervesHub Web Service by Nerves

CVE-2025-64097

What is CVE-2025-64097?

NervesHub, a web service for managing over-the-air firmware updates, has a vulnerability that enables attackers to brute-force user API tokens. This issue arose from the predictable structure of issued tokens, which contained user-identifiable components and lacked cryptographic security. As a result, attackers could potentially gain unauthorized access to user accounts or perform API actions protected by these tokens. A remediation has been implemented in version 2.3.0, which introduces strong cryptographically-random tokens and improved hashing and storage techniques. Until an upgrade, limiting access through firewalls may help reduce exposure.

References