WatchGuard Mobile VPN
CVE-2025-1549
MEDIUM
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local vector with low-privilege requirement; scope changes to elevated system context, justifying S:C and full C/H/I/A on the subsequent system.
Primary rating from Vendor (5d1c2695-1a31-4499-88ae-e847036fd7e3).
CVSS VectorVendor: 5d1c2695-1a31-4499-88ae-e847036fd7e3
Lifecycle Timeline
2DescriptionCVE.org
A local privilege escalation vulnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileges on the Windows system. This vulnerability is an additional unmitigated attack path for CVE-2024-4944.
This vulnerability is resolved in the Mobile VPN with SSL client for Windows version 12.11.5
AnalysisAI
Local privilege escalation in WatchGuard Mobile VPN with SSL client on Windows allows a low-privileged local user to inject and execute arbitrary commands with elevated system privileges via a command injection flaw (CWE-77). This vulnerability is explicitly described as an additional, previously unmitigated attack path for CVE-2024-4944, indicating that the earlier advisory's remediation was incomplete and the underlying injection surface persists in another code path. No public exploit identified at time of analysis, but the local-only attack vector limits exposure to insider threats and post-compromise lateral movement scenarios. A vendor-released patch is available in version 12.11.5.
Technical ContextAI
The vulnerability is rooted in CWE-77 (Improper Neutralization of Special Elements used in a Command - Command Injection), meaning the VPN client constructs OS-level commands by concatenating user-controlled input without adequate sanitization or escaping. On Windows, this pattern commonly emerges in VPN clients that invoke privileged helper processes or Windows services (running as SYSTEM or LocalSystem) to manage network adapters, routing tables, or DNS configuration. A low-privileged user can inject shell metacharacters or additional command arguments into an input path that is subsequently executed by the elevated component. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H) confirms that while the vulnerable process itself does not expose its own confidentiality or integrity, the subsequent system context - the elevated helper or service - is fully compromised (SC:H/SI:H/SA:H), consistent with a cross-privilege-boundary command injection pattern. The explicit link to CVE-2024-4944 suggests a shared root cause that was not fully remediated in the prior patch.
Affected ProductsAI
WatchGuard Mobile VPN with SSL client running on Microsoft Windows is affected. All versions prior to 12.11.5 are vulnerable. The vendor advisory at https://psirt.watchguard.com/CVE-2025-1549 and https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016 confirm the affected product scope. No CPE strings were provided in the source data; affected versions can be inferred as the Mobile VPN with SSL Windows client release line preceding 12.11.5. macOS or Linux VPN client variants are not referenced in this advisory.
RemediationAI
Upgrade WatchGuard Mobile VPN with SSL client for Windows to version 12.11.5, which the vendor confirms resolves this vulnerability. Details and download links are available at the official advisories: https://psirt.watchguard.com/CVE-2025-1549 and https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00016. Organizations should verify that systems previously patched for CVE-2024-4944 are also updated to 12.11.5, as that earlier patch did not cover this attack path. As a compensating control prior to patching, restrict local interactive logon and Remote Desktop access on endpoints running the VPN client to only trusted, necessary accounts - this raises the bar for exploitation by limiting who can reach the vulnerable local attack surface, though it does not eliminate the flaw. Monitoring for unusual process spawning from VPN client processes (e.g., cmd.exe or PowerShell as a child of the VPN client or its associated service) may help detect exploitation attempts.
More in Watchguard
View allWatchGuard Fireware OS contains an out-of-bounds write in IKEv2 VPN handling enabling unauthenticated remote code execut
Watchguard XCS 9.2 and 10.0 before build 150522 allow remote authenticated users to execute arbitrary commands via shell
Buffer overflow in WGagent in WatchGuard WSM and Fireware before 11.8 allows remote attackers to execute arbitrary code
Remote code execution in WatchGuard Fireware OS arises from an out-of-bounds write in the iked (IKE) daemon, letting an
SQL injection vulnerability in Watchguard XCS 9.2 and 10.0 before build 150522 allows remote attackers to execute arbitr
On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary code, aka FBX-22786. Rated criti
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15. Rated critical seve
Multiple cross-site request forgery (CSRF) vulnerabilities in Hexis HawkEye G 3.0.1.4912 allow remote attackers to hijac
An issue was discovered on WatchGuard AP100, AP102, and AP200 devices with firmware before 1.2.9.15, and AP300 devices w
WatchGuard RapidStream appliances allow local users to gain privileges and execute arbitrary commands via a crafted ifco
Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a
Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and install
Same weakness CWE-77 – Command Injection
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today