CVE-2025-54137
Published: 22 July 2025
Summary
CVE-2025-54137 is a high-severity Use of Default Credentials (CWE-1392) vulnerability in Psu Haxcms-Nodejs. Its CVSS base score is 7.3 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked in the top 34.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22383
Vulnerability details
HAX CMS NodeJS allows users to manage their microsite universe with a NodeJS backend. Versions 11.0.9 and below were distributed with hardcoded default credentials for the user and superuser accounts. Additionally, the application has default private keys for JWTs. Users…
more
aren't prompted to change credentials or secrets during installation, and there is no way to change them through the UI. An unauthenticated attacker can read the default user credentials and JWT private keys from the public haxtheweb GitHub repositories. These credentials and keys can be used to access unconfigured self-hosted instances of the application, modify sites, and perform further attacks. This is fixed in version 11.0.10.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Hardcoded default credentials for user and superuser accounts, along with publicly exposed default JWT private keys, enable attackers to use default accounts for unauthorized access to unconfigured self-hosted HAX CMS instances.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Mandates replacement of default credentials during secure configuration and provisioning procedures.
Policy requires changing or avoiding default credentials during system setup and operation.
Unique identification requirement prevents use of default or shared credentials by organizational users.
Changing default authenticators prior to first use prevents use of default credentials.
Standards-compliant authentication mechanisms typically prohibit default credentials for cryptographic modules.
Consistent implementation of the strategy drives removal or mitigation of default credentials in procured systems and services.
Security functional requirements and acceptance criteria can stipulate that acquired systems must not use default credentials.
Documentation of known configuration vulnerabilities and secure setup practices reduces reliance on default credentials.