Incorrect default permissions in Mobile VPN with SSL for Windows - CVE-2025-2781
Published: September 22, 2025
Vulnerability identifier: #VU116007
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-2781
CWE-ID: CWE-276
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due the Mobile VPN with SSL Client on Windows does not properly configure directory permissions when installed in a non-default directory. A local user with access to the system can view contents of files and directories or modify them, leading to privilege escalation.
Affected software
Mobile VPN with SSL for Windows
How to mitigate CVE-2025-2781
Install updates from vendor's website.
Mobile VPN with SSL for Windows - update to 12.11.2