CVE-2025-10678: NetBird VPN Auth Bypass Vulnerability

CVE-2025-10678 Overview

CVE-2025-10678 is a critical hardcoded credentials vulnerability affecting NetBird VPN installations. When installed using the vendor's provided script, NetBird VPN fails to remove or change the default password of an admin account created by ZITADEL. This vulnerability allows unauthenticated remote attackers to gain full administrative access to affected NetBird VPN instances using the well-known default credentials.

The vulnerability impacts instances installed using the vendor's provided installation script, as well as Docker-based deployments where administrators failed to change the default password or remove the default admin user. This represents a severe security configuration weakness (CWE-1392: Use of Default Credentials) that could lead to complete compromise of the VPN infrastructure.

Critical Impact

Unauthenticated attackers can gain full administrative access to NetBird VPN instances using default ZITADEL admin credentials, potentially compromising the entire VPN network infrastructure and connected systems.

Affected Products

• NetBird VPN versions prior to 0.57.0 installed using vendor's provided script
• NetBird VPN Docker deployments where default ZITADEL admin password was not changed
• NetBird VPN instances where the default ZITADEL admin user was not removed

Discovery Timeline

• 2025-10-20 - CVE-2025-10678 published to NVD
• 2025-10-21 - Last updated in NVD database

Technical Details for CVE-2025-10678

Vulnerability Analysis

This vulnerability stems from insecure default configuration in the NetBird VPN installation process. When administrators deploy NetBird VPN using the vendor-provided installation script, the ZITADEL identity management component creates an administrative account with a default password. The installation script fails to prompt for password changes or automatically remove this default account, leaving instances vulnerable to unauthorized access.

The network-accessible nature of this vulnerability combined with the lack of authentication requirements makes it trivially exploitable. An attacker with network access to the NetBird management interface can authenticate using the default ZITADEL admin credentials and gain complete control over the VPN infrastructure.

Successful exploitation would allow attackers to:

• Access and modify VPN configuration settings
• Create, modify, or delete user accounts
• Monitor VPN traffic and connected clients
• Potentially pivot to internal network resources accessible through the VPN
• Exfiltrate sensitive network configuration data

Root Cause

The root cause of CVE-2025-10678 is the use of default credentials (CWE-1392) in the ZITADEL identity management component during NetBird VPN installation. The vendor's installation script does not enforce credential rotation or removal of the default administrative account, leaving a predictable authentication bypass path for attackers.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by:

1. Identifying internet-exposed NetBird VPN management interfaces through network scanning
2. Attempting authentication with known default ZITADEL admin credentials
3. Upon successful authentication, gaining full administrative privileges over the VPN instance

The exploitation requires no special tools or techniques—only knowledge of the default credentials and network access to the management interface.

Detection Methods for CVE-2025-10678

Indicators of Compromise

• Successful authentication events for the default ZITADEL admin account from external IP addresses
• Unexpected administrative configuration changes in NetBird VPN settings
• Creation of new user accounts or modification of existing accounts without authorized administrator action
• Unusual login patterns or access times for administrative accounts

Detection Strategies

• Monitor authentication logs for successful logins using default admin credentials
• Implement alerting for administrative actions from unrecognized IP addresses or unusual geographic locations
• Review ZITADEL audit logs for unauthorized privilege escalation or account modifications
• Conduct regular credential audits to identify accounts still using default passwords

Monitoring Recommendations

• Enable comprehensive logging for all authentication events on NetBird VPN management interfaces
• Configure SIEM rules to detect authentication attempts using known default account names
• Implement network monitoring to identify unauthorized access to management ports
• Set up alerts for any configuration changes to critical VPN infrastructure components

How to Mitigate CVE-2025-10678

Immediate Actions Required

• Immediately change the default ZITADEL admin password on all NetBird VPN instances
• If the default admin account is not required, remove it entirely from the system
• Upgrade all NetBird VPN installations to version 0.57.0 or later
• Restrict network access to management interfaces using firewall rules
• Audit authentication logs for signs of prior unauthorized access using default credentials

Patch Information

NetBird has addressed this vulnerability in version 0.57.0. Organizations should upgrade to this version or later immediately. For detailed information about the fix and upgrade procedures, refer to the CERT Poland CVE-2025-10678 Analysis and the NetBird Official Website.

Workarounds

• Change the default ZITADEL admin password immediately upon installation if upgrading is not immediately possible
• Remove the default admin account entirely and create a new administrative account with strong credentials
• Implement network segmentation to restrict access to the NetBird management interface to trusted internal networks only
• Enable multi-factor authentication for all administrative accounts if supported
• Deploy a web application firewall or reverse proxy to add additional authentication layers in front of the management interface

# Configuration example
# Restrict access to NetBird management interface via firewall
# Allow only trusted administrator IP ranges
iptables -A INPUT -p tcp --dport 443 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify no default admin accounts exist
# Review ZITADEL user list and remove default accounts