CVE-2025-2781

MEDIUM EPSS 2.0%

Published Mar 28, 20251y ago · Modified Jun 17, 20262w ago

6.3 CVSS 4.0

Medium

Published Mar 28, 2025 1y ago

Last Modified Jun 17, 2026 2w ago

Description

The WatchGuard Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. This could allow an authenticated local attacker to escalate to SYSTEM privileges on a vulnerable system. This issue affects Mobile VPN with SSL Client: from 11.0 through 12.11.

CVSS Details

Base Score

6.3

Exploitability

—

Impact

—

Vector string

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector Local

Attack Complexity Low

Privileges Required Low

User Interaction None

Scope X

Threat Intelligence

EPSS Exploit Probability

2.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-276

References 1

watchguard.com https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00004

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.