CVE-2025-54870
Published: 05 August 2025
Summary
CVE-2025-54870 is a high-severity Failing Open (CWE-636) vulnerability. Its CVSS base score is 8.7 (High).
Operationally, ranked at the 43.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-23579
Vulnerability details
VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules might cause reversion to plaintext due to insufficient error handling. The bug was first introduced in VTun-ng version 3.0.12. This is fixed…
more
in version 3.0.18. To workaround this issue, avoid blowfish-256.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Ensures audit logging continues on primary failure instead of failing open with no logging capability.
Supports failing securely by requiring alerts and configurable actions (e.g., shutdown) when the audit mechanism fails instead of continuing without it.
Entering safe mode when conditions are detected prevents failing open and continuing normal operation in a potentially exploitable state.
Ensures security functions remain enforced via alternatives instead of defaulting to an insecure state when the primary means fails.
Fail-safe-defaults principle prevents systems from failing open.
Directly requires transition to a known (secure) state on failure, preventing fail-open behavior.
Standby components and explicit exchange criteria enforce a controlled, secure failover instead of failing open.
Directly implements fail-safe (fail-closed/secure) behavior on indicated failures, preventing the system from defaulting to an insecure open state.