Is CVE-2025-64097 actively exploited?

No active exploitation of CVE-2025-64097 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2025-64097 be exploited remotely?

Yes. CVE-2025-64097 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2025-64097?

CVE-2025-64097 has a CVSS score of 9.8 (CRITICAL).

HOME VULNERABILITIESCVE-2025-64097

CRITICAL

CVE-2025-64097

CWE-330Published: January 22, 2026· Updated: Jun 17, 2026

9.8

CVSS v3.1

Official Description

NervesHub is a web service that allows users to manage over-the-air (OTA) firmware updates of devices in the field. A vulnerability present starting in version 1.0.0 and prior to version 2.3.0 allowed attackers to brute-force user API tokens due to the predictable format of previously issued tokens. Tokens included user-identifiable components and were not cryptographically secure, making them susceptible to guessing or enumeration. The vulnerability could have allowed unauthorized access to user accounts or API actions protected by these tokens. A fix is available in version 2.3.0 of NervesHub. This version introduces strong, cryptographically-random tokens using `:crypto.strong_rand_bytes/1`, hashing of tokens before database storage to prevent misuse even if the database is compromised, and context-aware token storage to distinguish between session and API tokens. There are no practical workarounds for this issue other than upgrading. In sensitive environments, as a temporary mitigation,

firewalling access to the NervesHub server can help limit exposure until an upgrade is possible.

NVD Source

Risk Analysis

NervesHub is vulnerable to API token brute-forcing due to the use of predictable, non-cryptographically secure token formats. This allows unauthorized access to user accounts and API actions. The critical severity reflects the risk of widespread account compromise.

No public exploit is known, and the issue is not in CISA KEV. It is remotely exploitable.

Recommended Action

Upgrade NervesHub to version 2.3.0 or later, which implements cryptographically secure token generation and hashing. Revoke and rotate any potentially compromised API tokens.

Generated by the CTIWATCH analysis pipeline from this CVE's metadata (CVSS, EPSS, KEV status, exploit intelligence). Verify against vendor advisories before acting.

Technical Analysis

CVE-2025-64097 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 9.8.