External risk intelligence

NetBird VPN Default Admin Password Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-10678

NetBird is a VPN solution, which is an identity and network access service designed to be internet-facing to facilitate remote connectivity. The vulnerability involves default credentials for an admin account on these instances, which are typically exposed as public-facing gateways or identity portals by design.

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in NetBird VPN, specifically affecting installations that used the vendor's provided script. The issue stems from a default administrative account password that was not properly changed or removed, potentially leaving these VPN instances exposed. The primary concern is to confirm if your NetBird instances were installed in this manner and if the default credentials were altered.

A default password allows unauthorized admin access.
Critical for VPNs, affecting remote access security.
Confirm NetBird installation method and password hygiene.

Attack Path

How an attacker could exploit the issue

An attacker could gain administrative access to a NetBird VPN instance that was installed using the vendor's script. This is possible because the script failed to properly secure an administrator account by not changing or removing its default password. If successful, an attacker could leverage this access to control the VPN.

No special access is required.
The default admin password is not changed.
Risk of unauthorized administrative control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could expose administrative access to NetBird VPN instances that were set up using the vendor's provided script, or potentially Docker installations where default passwords were not changed. This could lead to unauthorized control over the VPN service and its network.

Admin access to VPN service.
Default credentials left unchanged.
Unauthorized network control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The NetBird VPN, particularly instances installed via the vendor's script or potentially Docker installations that haven't changed default admin credentials, presents a critical risk due to a default administrative account. Infrastructure or platform teams are likely responsible for managing these VPN instances. The immediate first step should be to identify all NetBird deployments, assess their reachability and business criticality, and then confirm ownership to plan for remediation.

Identify and confirm NetBird instance ownership.
Verify admin account password and user status.
Plan remediation based on exposure and criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is NetBird VPN?

NetBird is a software-defined networking solution that builds secure, encrypted VPN tunnels. It utilizes ZITADEL for identity management to authenticate users and manage access to private network resources, making it a critical component for facilitating remote work connectivity and secure communications across distributed environments.

What does CWE-1392 mean for CVE-2025-10678?

CWE-1392 refers to the use of default credentials, which is the core weakness here. In the context of CVE-2025-10678, the software's automated setup process creates an administrative account with a preset password that remains active. This allows anyone who knows or guesses that default password to log in with full administrative privileges, effectively bypassing standard security access controls.

How does an attacker trigger this vulnerability?

An attacker triggers this by attempting to log into the NetBird administrative interface using the known default password. This vulnerability only exists if the default password was never changed or the account was never removed following the initial installation. It is not triggered by exploiting software code flaws or memory errors, but rather by the presence of unmanaged, factory-default authentication credentials.

Why is this a high-priority risk?

As noted by Halo Surface Signal, NetBird acts as a gateway for network access. Because these instances are often intentionally internet-facing to support remote connectivity, they are highly discoverable. If the administrative portal is reachable from the public internet and uses default credentials, an unauthorized user can gain complete control over your VPN infrastructure.

Do I need to update my NetBird software?

Yes, you should prioritize updating to version 0.57.0 or newer, as this release addresses the installation behavior. Beyond updating, immediately verify that no active accounts are using default passwords. Review your deployment logs to determine if you used the affected installation script or Docker configuration, and rotate credentials for all administrative users to ensure your instance is secure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.