Versa SASE Client CVE-2025-34290

The vulnerability affects the Versa SASE Client for Windows, an endpoint agent for Versa Networks' Secure Access Service Edge platform used for zero-trust network access. The root cause is CWE-250 (Execution with Unnecessary Privileges): a Windows service running as NT AUTHORITY\SYSTEM accepts user-controlled file path arguments from an unprivileged client process via the audit log export function without adopting the caller's security context through impersonation. This creates a TOCTOU (time-of-check time-of-use) race condition: during the interval between the service resolving the supplied path and performing the deletion, the attacker can interpose a Windows symbolic link or directory mount point (junction) redirecting the operation to an arbitrary target directory. The privileged service then deletes the attacker-chosen target rather than the legitimate audit log path. Targeting C:\Config.msi - used by the Microsoft Windows Installer subsystem - then enables an MSI rollback attack: Windows Installer, also operating as SYSTEM, executes attacker-staged payloads during the rollback sequence. The CVSS 4.0 vector AV:L/AC:L/AT:N/PR:L/VC:H/VI:H/VA:H confirms local attack vector, low-privilege authentication, and full vulnerable-system impact.