CVE-2025-65199
🟡 Monitoruj
Wstrzyknięcie poleceń w aplikacji Windscribe dla Linux umożliwia lokalnemu użytkownikowi wykonanie dowolnych komend jako root.
CVSS
7.8
EPSS
1.3%
Exploit
poc
Vendor
windscribe
Opis źródłowy (NVD)
A command injection vulnerability exists in Windscribe for Linux Desktop App that allows a local user who is a member of the windscribe group to execute arbitrary commands as root via the 'adapterName' parameter of the 'changeMTU' function. Fixed in Windscribe v2.18.3-alpha and v2.18.8.
exploit rce
Brak patcha
Źródła i daty
| Źródło | Wartość |
|---|---|
| NVD – CVSS | 7.8 |
| CISA KEV (aktywnie wykorzystywane) | Nie |
| FIRST EPSS (prawdopodobieństwo exploita) | 1.3% |
| Opublikowano (NVD) | 2025-12-10 19:16:34 UTC |
| Ostatnia modyfikacja (NVD) | 2026-09-28 22:10:00 UTC |
Referencje
- https://github.com/Windscribe/Desktop-App (9119a7d8-5eab-497f-8521-727c672e3725) [Product]
- https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-57e27ab201a1a612609087b839e03bf87a5a063ffcc3f465a6245469bc102754 (9119a7d8-5eab-497f-8521-727c672e3725) [Patch]
- https://github.com/Windscribe/Desktop-App/compare/v2.18.2...v2.18.3?diff=unified&w#diff-cfc5df17057ed92112ae70a42c81c57c79f434429210ff881fb0771cf8e39b4c (9119a7d8-5eab-497f-8521-727c672e3725) [Patch]
- https://hackingbydoing.wixsite.com/hackingbydoing/post/windscribe-vpn-local-privilege-escalation (9119a7d8-5eab-497f-8521-727c672e3725) [Exploit, Press/Media Coverage, Third Party Advisory]
- https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/IT/white/2025/va-25-343-01.json (9119a7d8-5eab-497f-8521-727c672e3725) [Third Party Advisory]
- https://www.cve.org/CVERecord?id=CVE-2025-65199 (9119a7d8-5eab-497f-8521-727c672e3725) [Third Party Advisory, US Government Resource]