PT-2025-26819 · Cyberduck+1 · Cyberduck+1

Andreas Boll + 1 · Published 2025-06-25 · Updated 2025-06-30 · CVE-2025-41255

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Cyberduck versions prior to 9.1.7 Mountain Duck versions prior to 4.17.6

Description: The issue concerns improper handling of TLS certificate pinning for untrusted certificates, such as self-signed ones. This results in the unnecessary installation of these certificates to the Windows Certificate Store of the current user without any restrictions.

Recommendations: For Cyberduck versions prior to 9.1.7, update to version 9.1.7 or later to resolve the issue. For Mountain Duck versions prior to 4.17.6, update to version 4.17.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the certificate installation process to minimize the risk of exploitation.

Exploit

Fix

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-41255

GHSA-VJJC-GRPP-M655

Affected Products

Cyberduck

Mountain Duck

References · 8

• 🔥 https://github.com/iterate-ch/cyberduck/security/advisories/GHSA-vjjc-grpp-m655 · Exploit
• 🔥 https://github.com/sbaresearch/advisories/tree/public/2025/SBA-ADV-20250325-01_Cyberduck_Mountain_Duck_Certificate_Handling · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-41255 · Security Note
• https://osv.dev/vulnerability/CVE-2025-41255 · Vendor Advisory
• https://twitter.com/cracbot/status/1939640104143986819 · Twitter Post
• https://twitter.com/CVEnew/status/1937809339638554911 · Twitter Post
• https://t.me/cvenotify/126611 · Telegram Post
• https://t.me/cvetracker/27004 · Telegram Post