CVE-2025-65199

Katalog CVE

CVSS 7.8 · High EPSS 1,3%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada windscribe. Skor CVSS 3.1 7.8 (High) menurut CNA.

Deskripsi (NVD)

A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.

Rincian

Terbit di NVD

10 Desember 2025

Terakhir diubah

28 September 2026

Status NVD

Analyzed

CVSS 3.1

7.8 (High), sumber CNA
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-57e27ab201a1a612609087... patch
• https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-cfc5df17057ed92112ae70... patch
• https://www.cve.org/CVERecord?id=CVE-2025-65199 advisory pihak ketiga · pemerintah AS
• https://hackingbydoing.wixsite.com/hackingbydoing/post/windscribe-vpn-local-privilege-escalation exploit · press/media coverage · advisory pihak ketiga
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-343-01.json advisory pihak ketiga
• https://github.com/Windscribe/Desktop-App product