PT-2025-8961 · Unknown · Velociraptor

Darragh Oreilly · Published 2025-02-27 · Updated 2025-02-28 · CVE-2025-0914

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Velociraptor versions prior to 0.73.4

Description The issue is related to improper access control in the VQL shell feature, allowing authenticated users to execute the execve() plugin even when it is explicitly forbidden by the prevent execve flag in the configuration file. This setting is not commonly used, so the issue will only affect users who have set it.

Recommendations For versions prior to 0.73.4, update to release 0.73.4 to resolve the issue.

Fix

LPE

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

CVE-2025-0914

Affected Products

Velociraptor

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-0914 · Security Note
• https://twitter.com/WolfgangSesin/status/1895408319252070567 · Twitter Post
• https://twitter.com/CVEnew/status/1895241185893196166 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1895229354516390294 · Twitter Post
• https://t.me/cvedetector/19062 · Telegram Post
• https://docs.velociraptor.app/announcements/advisories/cve-2025-0914 · Note