CVE-2025-12286
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-27

Last updated on: 2026-02-24

Assigner: VulDB

Description
A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-27
Last Modified
2026-02-24
Generated
2026-06-16
AI Q&A
2025-10-27
EPSS Evaluated
2026-06-15
NVD
CVE-2025-12286
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
veepn veepn 1.6.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-428 The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CWE-426 The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is an unquoted search path weakness in the AVService component of VeePN up to version 1.6.2. It affects an unknown function in the avservice.exe file. The issue arises because the path used by the service is not properly quoted, which can allow an attacker with local access to manipulate the search path and potentially execute malicious code. Exploiting this vulnerability requires a high degree of complexity and local access, making it difficult to exploit.

Impact Analysis

If exploited, this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the high impact scores on confidentiality, integrity, and availability. An attacker with local access could potentially execute arbitrary code with elevated privileges, leading to unauthorized access or disruption of services.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-12286. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart