CVE-2025-64097

CVE-2025-64097 describes a critical vulnerability in NervesHub versions 1.0.0 through 2.2.x, affecting its ability to manage over-the-air firmware updates. Attackers could brute-force user API tokens due to their predictable, non-cryptographically secure format, potentially leading to unauthorized access to user accounts and API actions. With a CVSS score of 9.8 (CRITICAL), this vulnerability allows unauthenticated remote attackers to achieve high impact on confidentiality, integrity, and availability. While there is no evidence of active exploitation or publicly available exploit code, the vulnerability has garnered significant community discussion, with 10 mentions. Upgrading to NervesHub version 2.3.0, which implements strong, cryptographically random tokens and secure storage, is the only practical remediation.