PT-2025-23820 · Cisco · Cisco Thousandeyes Endpoint Agent For Windows

Peter Fejér · Published 2025-06-04 · Updated 2025-07-22 · CVE-2025-20259

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cisco ThousandEyes Endpoint Agent for Windows (affected versions not specified)

Description The issue is related to improper access controls on files in the local file system of the Cisco ThousandEyes Endpoint Agent for Windows. An authenticated, local attacker could exploit this by using a symbolic link to perform an agent upgrade, redirecting the delete operation of any protected file. This could allow the attacker to delete arbitrary files from the file system of the affected device.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-08245

CVE-2025-20259

Affected Products

Cisco Thousandeyes Endpoint Agent For Windows

References · 9

• https://bdu.fstec.ru/vul/2025-08245 · Security Note
• https://osv.dev/vulnerability/CVE-2025-20259 · Vendor Advisory
• https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-te-endagent-filewrt-zNcDqNRJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-20259 · Security Note
• https://twitter.com/CVEnew/status/1930305580213907525 · Twitter Post
• https://t.me/cveNotify/129838 · Telegram Post
• https://t.me/cvetracker/25415 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1930372238731010132 · Twitter Post
• https://t.me/cvenotify/129838 · Telegram Post