CVE-2025-54410
Mobyproject Moby ≤ 25.0.13
Raw vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:NSummary
CVE-2025-54410 is a low-severity Missing Initialization of Resource (CWE-909) vulnerability in Mobyproject Moby. Its CVSS base score is 3.3 (Low).
Operationally, ranked at the 5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23166
Vulnerability Data
Moby is an open source container framework developed by Docker Inc. that is distributed as Docker Engine, Mirantis Container Runtime, and various other downstream projects/products. A firewalld vulnerability affects Moby releases before 28.0.0. When firewalld reloads, Docker fails to re-create…
more
iptables rules that isolate bridge networks, allowing any container to access all ports on any other container across different bridge networks on the same host. This breaks network segmentation between containers that should be isolated, creating significant risk in multi-tenant environments. Only containers in --internal networks remain protected. Workarounds include reloading firewalld and either restarting the docker daemon, re-creating bridge networks, or using rootless mode. Maintainers anticipate a fix for this issue in version 25.0.13.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover missing initialization through static analysis or test cases.
Documented development standards and processes can mandate initialization of critical resources.
Security engineering principles can require explicit resource initialization during design and coding.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly require proper resource initialization as part of coding standards and verification.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing initialization defects before deployment.
Secure development life cycle mandates initialization of resources before use.
Application security requirements can specify resource initialization checks.
Secure architecture principles include proper resource lifecycle management.
Secure coding standards explicitly require initialization of variables and resources.
Change management can enforce review of initialization logic during modifications.