CVE-2025-66575
VeeVPN 1.6.1 - Unquoted Service Path Remote Code Execution
- State
- Published
- Severity
- 8.5 High
- Published
- Dec 4, 2025
- Updated
- Dec 5, 2025
- Reserved
- Dec 4, 2025
Description
VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.5 High | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P | VulnCheck |
Weaknesses
- CWE-428 Unquoted Search Path or Element
Affected Products
| Product | Versions |
|---|---|
VeeVPNVeePN |
|
References
- ExploitDB-52088exploit
- VeePN Homepageproduct
- VeePN GitHub Repositoryproduct
- https://www.vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-executionthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.