PT-2025-49151 · Veevpn · Veevpn

Published 2025-12-04 · Updated 2025-12-30 · CVE-2025-66575

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions VeeVPN version 1.6.1

Description VeeVPN version 1.6.1 has an issue with an unquoted service path in the VeePNService. This allows remote attackers to potentially run code when the system starts or restarts, gaining higher privileges. An attacker can exploit this by supplying a malicious service name, which allows them to inject commands and operate as LocalSystem.

Recommendations Update VeeVPN to a version with a fix for this issue. As a temporary workaround, consider restricting the service name allowed for the VeePNService.

Exploit

Fix

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2025-66575

Affected Products

Veevpn

References · 9

• 🔥 https://exploit-db.com/exploits/52088 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-66575 · Security Note
• https://osv.dev/vulnerability/CVE-2025-66575 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1996833379308761251 · Twitter Post
• ❌ https://github.com/veepn/veepn · Note, Deleted
• https://vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-execution · Note
• https://twitter.com/CVEnew/status/1996685090135453914 · Twitter Post
• https://veepn.com · Note
• https://t.me/cveNotify/147173 · Telegram Post