CVE-2025-2781

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system. This issue affects Mobile VPN with SSL Client: from 11.0 through 12.11.

CVSS

No CVSS.

References

Link	Resource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00004

Configurations

No configuration.

History

01 Apr 2025, 20:26

Type	Values Removed	Values Added
Summary		(es) WatchGuard Mobile VPN with SSL Client en Windows no configura correctamente los permisos de directorio al instalarse en un directorio distinto al predeterminado. Esto podría permitir que un atacante local autenticado obtenga privilegios de SYSTEM en un sistema vulnerable. Este problema afecta a Mobile VPN con SSL desde la versión 11.0 hasta la 12.11.

28 Mar 2025, 23:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-03-28 23:15

Updated : 2025-04-01 20:26

NVD link : CVE-2025-2781

Mitre link : CVE-2025-2781

CVE.ORG link : CVE-2025-2781

JSON object : View

Products Affected

No product.

CWE

CWE-276

Incorrect Default Permissions

{"id": "CVE-2025-2781", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-03-28T23:15:18.157", "references": [{"url": "https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00004", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "5d1c2695-1a31-4499-88ae-e847036fd7e3", "description": [{"lang": "en", "value": "CWE-276"}]}], "descriptions": [{"lang": "en", "value": "The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system.\n\n\n\nThis issue affects Mobile VPN with SSL Client: from 11.0 through 12.11."}, {"lang": "es", "value": "WatchGuard Mobile VPN with SSL Client en Windows no configura correctamente los permisos de directorio al instalarse en un directorio distinto al predeterminado. Esto podr\u00eda permitir que un atacante local autenticado obtenga privilegios de SYSTEM en un sistema vulnerable. Este problema afecta a Mobile VPN con SSL desde la versi\u00f3n 11.0 hasta la 12.11."}], "lastModified": "2025-04-01T20:26:30.593", "sourceIdentifier": "5d1c2695-1a31-4499-88ae-e847036fd7e3"}