BaseFortify

Publication date: 2025-10-27

Last updated on: 2026-02-24

Assigner: VulDB

Description

A weakness has been identified in VeePN up to 1.6.2. This affects an unknown function of the file C:\Program Files (x86)\VeePN\avservice\avservice.exe of the component AVService. This manipulation causes unquoted search path. The attack requires local access. A high degree of complexity is needed for the attack. The exploitability is reported as difficult. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-27

Last Modified

2026-02-24

Generated

2026-07-07

AI Q&A

2025-10-27

EPSS Evaluated

2026-07-06

NVD

CVE-2025-12286

Affected Vendors & Products

Vendor	Product	Version / Range
veepn	veepn	1.6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-426	The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
CWE-428	The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

Attack-Flow Graph

Executive Summary

This vulnerability is an unquoted search path weakness in the AVService component of VeePN up to version 1.6.2. It affects an unknown function in the avservice.exe file. The issue arises because the path used by the service is not properly quoted, which can allow an attacker with local access to manipulate the search path and potentially execute malicious code. Exploiting this vulnerability requires a high degree of complexity and local access, making it difficult to exploit.

Impact Analysis

If exploited, this vulnerability can lead to complete compromise of confidentiality, integrity, and availability of the affected system, as indicated by the high impact scores on confidentiality, integrity, and availability. An attacker with local access could potentially execute arbitrary code with elevated privileges, leading to unauthorized access or disruption of services.

Hi! I’m here to help you understand CVE-2025-12286. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70