CVE-2025-12286
BaseFortify
Publication date: 2025-10-27
Last updated on: 2026-02-24
Assigner: VulDB
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| veepn | veepn | 1.6.2 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-426 | The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. |
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted search path weakness in the AVService component of VeePN up to version 1.6.2. It affects an unknown function in the avservice.exe file. The issue arises because the path used by the service is not properly quoted, which can allow an attacker with local access to manipulate the search path and potentially execute malicious code. Exploiting this vulnerability requires a high degree of complexity and local access, making it difficult to exploit.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the high impact scores on confidentiality, integrity, and availability. An attacker with local access could potentially execute arbitrary code with elevated privileges, leading to unauthorized access or disruption of services.