PT-2025-39798 · Ihongren · Ihongren Pptp-Vpn

Swayzgl1Tzyyy · Published 2025-09-29 · Updated 2025-10-04 · CVE-2025-11130

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions iHongRen pptp-vpn versions 1.0 and 1.0.1

Description A security issue has been identified in iHongRen pptp-vpn on macOS. The problem resides in the shouldAcceptNewConnection function within the HelpTool/HelperTool.m file of the XPC Service component, leading to missing authentication. This allows local attackers to bypass authentication mechanisms. The exploit for this issue is publicly available. The vendor was informed of this issue but did not provide a response.

Recommendations For iHongRen pptp-vpn version 1.0, restrict access to the vulnerable component XPC Service. For iHongRen pptp-vpn version 1.0.1, restrict access to the vulnerable component XPC Service.

Exploit

Fix

Missing Authentication

Improper Authentication

Weakness Enumeration

CWE-306

CWE-287

Related Identifiers

CVE-2025-11130

Affected Products

Ihongren Pptp-Vpn

References · 12

• 🔥 https://github.com/SwayZGl1tZyyy/n-days/blob/main/pptp-vpn/README.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-11130 · Security Note
• https://twitter.com/CVEnew/status/1972492596996870349 · Twitter Post
• https://t.me/cveNotify/136759 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1972516063184089230 · Twitter Post
• https://twitter.com/offseq/status/1972519817748852980 · Twitter Post
• https://twitter.com/cracbot/status/1974429329804128668 · Twitter Post
• https://vuldb.com/?submit.655456 · Note
• https://twitter.com/CveFindCom/status/1972461246755577949 · Twitter Post
• https://vuldb.com/?ctiid.326210 · Note
• https://t.me/CVEtracker/33600 · Telegram Post
• https://vuldb.com/?id.326210 · Note