Cyber Resilience

CVE-2025-54870

Published
05 August 2025
Modified
17 June 2026
CVSS Score v4 8.7
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0020 10th percentile
Risk Priority 43 floored blend · peak EPSS

Summary

CVE-2025-54870 is a high-severity Failing Open (CWE-636) vulnerability. Its CVSS base score is 8.7 (High).

Operationally, ranked at the 10th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to CP-12 (Safe Mode) and SC-24 (Fail in Known State) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

A10:2025 Mishandling of Exceptional Conditions

EU & UK References

Vulnerability Data

VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed…

more

in version 3.0.18. To workaround this issue, avoid blowfish-256.

CWE(s)
CWE-636

Related Threats

CVEs Like This One

CVE-2026-40525Shared CWE-636
CVE-2026-53852Shared CWE-636
CVE-2026-53837Shared CWE-636
CVE-2026-69306Shared CWE-636
CVE-2025-21210Shared CWE-636
CVE-2023-4030Shared CWE-636
CVE-2026-42423Shared CWE-636
CVE-2026-22034Shared CWE-636
CVE-2026-41334Shared CWE-636
CVE-2024-8185Shared CWE-636

Affected Assets

—
In
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V3.2.1
  • V7.4.1
  • V8.3.3
  • V10.3.4

Mitigating Controls (NIST 800-53 r5) AI

SC-24 Fail in Known State good match

SC-24 directly requires the system to fail to a known state that preserves security properties, structurally stopping fallback to a less-secure mode.

SI-17 Fail-safe Procedures good match

SI-17 mandates explicit fail-safe procedures that activate on indicated failures, preventing the insecure fallback behavior.

CP-12 Safe Mode good match

CP-12 forces entry into a safe mode on detected conditions, limiting exposure but not covering every failure path.

SA-8 Security and Privacy Engineering Principles partial match

SA-8 requires application of engineering principles that include fail-secure design, reducing the likelihood the weakness is introduced.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure-development practices explicitly include designing error and failure handling to remain in a secure state.

PR.AA-05 partial match
prevents

Least-privilege policy and enforcement directly counters the permissive-access fallback example in the CWE.

PR.PS-01 partial match
prevents

Hardened baselines and configuration management reduce the chance that error paths default to insecure settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.25 Assessment and decision on information security events none match
none

The control forces an explicit evaluation step before any response, reducing the chance that a failure condition will default to an unsafe open state.

References