What is the CVSS score of CVE-2025-5687?

CVE-2025-5687 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Mozilla are affected by CVE-2025-5687?

A privilege escalation vulnerability in Mozilla VPN on macOS (CVE-2025-5687) allows unauthorized users to gain root access on affected systems.

How to fix or mitigate CVE-2025-5687?

Within 24 hours: Identify and inventory all macOS endpoints running Mozilla VPN versions prior to the patched release; assess business criticality of affected systems. Within 7 days: Restrict Mozilla VPN usage to administrative users only or disable it on non-critical systems; communicate findings and interim controls to stakeholders. Within 30 days: Monitor Mozilla security advisories for patch release; conduct risk reassessment and deploy patch immediately upon availability; consider alternative VPN solutions if patch delays extend beyond 30 days.

Mozilla CVE-2025-5687

EUVD-2025-18102 HIGH

Improper Privilege Management (CWE-269)

2025-06-11 security@mozilla.org

Mozilla Privilege Escalation Apple

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18102

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 12:15 nvd

HIGH 7.8

DescriptionCVE.org

A vulnerability in Mozilla VPN on macOS allows privilege escalation from a normal user to root. *This bug only affects Mozilla VPN on macOS. Other operating systems are unaffected.* This vulnerability affects Mozilla VPN 2.28.0 < (macOS).

AnalysisAI

Local privilege escalation vulnerability in Mozilla VPN for macOS that allows an authenticated local user to escalate privileges from normal user to root. This affects Mozilla VPN versions below 2.28.0 on macOS exclusively. An attacker with local access can exploit this without user interaction to gain complete system control, making it a critical risk for multi-user systems or compromised local accounts.

Technical ContextAI

The vulnerability stems from an improper privilege management flaw (CWE-269: Improper Access Control) within Mozilla VPN's macOS implementation. CWE-269 encompasses failures in authorization logic where system components fail to properly validate or enforce privilege boundaries before executing sensitive operations. Mozilla VPN on macOS likely uses system-level network extensions or helper processes that run with elevated privileges; the vulnerability suggests that the VPN client fails to properly validate the calling user's permissions before executing root-level operations. This could manifest as an unprotected IPC mechanism, unsafe file operations with improper permission checks, or direct invocation of privileged helper tools without adequate authentication. The macOS-specific nature indicates platform-specific kernel APIs or system frameworks (possibly Network Extension framework or similar) are involved. CPE affected: cpe:2.4:a:mozilla:mozilla_vpn:*:*:*:*:*:macos:* with version range < 2.28.0.

RemediationAI

Upgrade Mozilla VPN to version 2.28.0 or later on macOS; priority: Critical; details: Users should update immediately via the App Store or Mozilla's official download page. Mozilla VPN typically auto-updates on macOS, but users should verify they are on version 2.28.0+ Workaround: Until patched, restrict local system access and disable Mozilla VPN on shared or untrusted systems; priority: High; details: Disable or uninstall Mozilla VPN on multi-user macOS systems until patch is applied. Use alternative VPN solutions if Mozilla VPN is essential. Ensure user accounts are password-protected and strong; monitor for unauthorized local access. Detection: Monitor for unusual root-level process spawning or privilege escalation attempts from VPN processes; priority: Medium; details: EDR/MDM tools should flag suspicious helper process invocations or IPC calls from com.mozilla.macos.FirefoxVPN or related bundles