Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-1549

Summary
Assigner-WatchGuard
Assigner Org ID-5d1c2695-1a31-4499-88ae-e847036fd7e3
Published At-29 Oct, 2025 | 16:50
Updated At-26 Feb, 2026 | 16:57
Rejected At-
Credits

WatchGuard Mobile VPN with SSL Local Privilege Escallation

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
▼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:WatchGuard
Assigner Org ID:5d1c2695-1a31-4499-88ae-e847036fd7e3
Published At:29 Oct, 2025 | 16:50
Updated At:26 Feb, 2026 | 16:57
Rejected At:
▼CVE Numbering Authority (CNA)
WatchGuard Mobile VPN with SSL Local Privilege Escallation

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5

Affected Products
Vendor
WatchGuard Technologies, Inc.WatchGuard
Product
Mobile VPN with SSL Client
Platforms
  • Windows
Default Status
unaffected
Versions
Affected
  • From 12.0 through 12.11.5 (semver)
Problem Types
TypeCWE IDDescription
CWECWE-77CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Type: CWE
CWE ID: CWE-77
Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Metrics
VersionBase scoreBase severityVector
4.06.3MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Version: 4.0
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H
Metrics Other Info
Impacts
CAPEC IDDescription
CAPEC-233CAPEC-233 Privilege Escalation
CAPEC ID: CAPEC-233
Description: CAPEC-233 Privilege Escalation
Solutions
Configurations
Workarounds
Exploits
Credits
finder
Defence Tech Malware Lab
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016
N/A
Hyperlink: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016
Resource: N/A
▼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
▼National Vulnerability Database (NVD)
nvd.nist.gov
Source:5d1c2695-1a31-4499-88ae-e847036fd7e3
Published At:29 Oct, 2025 | 17:15
Updated At:04 Dec, 2025 | 23:15

A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944. This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary4.06.3MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Type: Secondary
Version: 4.0
Base score: 6.3
Base severity: MEDIUM
Vector:
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CPE Matches
Weaknesses
CWE IDTypeSource
CWE-77Secondary5d1c2695-1a31-4499-88ae-e847036fd7e3
CWE ID: CWE-77
Type: Secondary
Source: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-000165d1c2695-1a31-4499-88ae-e847036fd7e3
N/A
Hyperlink: https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016
Source: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Resource: N/A

Change History

0
Information is not available yet

Similar CVEs

3Records found
CVE-2025-1910
Matching Score-10
Assigner-WatchGuard Technologies, Inc.
ShareView Details
Matching Score-10
Assigner-WatchGuard Technologies, Inc.
CVSS Score-6.3||MEDIUM
EPSS-0.21% / 10.98%
||
7 Day CHG~0.00%
Published-04 Dec, 2025 | 21:56
Updated-26 Feb, 2026 | 16:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
WatchGuard Mobile VPN with SSL Local Privilege Escalation via Update Package

The WatchGuard Mobile VPN with SSL Client on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM on the Windows machine where the VPN Client is installed.This issue affects the Mobile VPN with SSL Client 12.0 up to and including 12.11.2.

Action-Not Available
Vendor-WatchGuard Technologies, Inc.
Product-Mobile VPN with SSL Client
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-4944
Matching Score-6
Assigner-WatchGuard Technologies, Inc.
ShareView Details
Matching Score-6
Assigner-WatchGuard Technologies, Inc.
CVSS Score-7.8||HIGH
EPSS-0.31% / 22.77%
||
7 Day CHG~0.00%
Published-09 Jul, 2024 | 02:23
Updated-22 Aug, 2024 | 15:06
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Mobile VPN with SSL Local Privilege Escalation Vulnerability

A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged.

Action-Not Available
Vendor-WatchGuard Technologies, Inc.Microsoft Corporation
Product-windowsmobile_vpn_with_sslMobile VPN with SSL Clientmobile_vpn_with_ssl
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CVE-2024-1417
Matching Score-6
Assigner-WatchGuard Technologies, Inc.
ShareView Details
Matching Score-6
Assigner-WatchGuard Technologies, Inc.
CVSS Score-7.8||HIGH
EPSS-0.72% / 49.13%
||
7 Day CHG~0.00%
Published-16 May, 2024 | 17:56
Updated-15 Apr, 2026 | 00:35
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Local Code Injection Vulnerability in AuthPoint Password Manager App for macOS Safari

Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in WatchGuard AuthPoint Password Manager on MacOS allows an a adversary with local access to execute code under the context of the AuthPoint Password Manager application. This issue affects AuthPoint Password Manager for MacOS versions before 1.0.6.

Action-Not Available
Vendor-WatchGuard Technologies, Inc.
Product-AuthPoint Password Managerauthpoint_password_manager
CWE ID-CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
Details not found