EUVD-2025-209612CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionNVD
A privilege escalation vulnerability exists during the installation of Norton Secure VPN via the Microsoft Store. A low-privilege user can replace files during the installation process, which may result in deletion of arbitrary files that can lead to elevation of privileges.
AnalysisAI
Norton Secure VPN installed via Microsoft Store allows low-privilege Windows users to escalate to SYSTEM-level privileges by replacing files during the installation process, causing arbitrary file deletion. Cisco Talos discovered this TOCTOU (Time-of-Check Time-of-Use) race condition in the installer. No public exploit code or active exploitation confirmed at time of analysis, but the local attack vector with low complexity (CVSS AC:L) makes this highly exploitable once installation details are known.
Technical ContextAI
This vulnerability stems from CWE-1386 (Insecure Operation on Windows Junction/Mount Point), a class of TOCTOU race conditions specific to Windows file system operations. During Norton Secure VPN installation via Microsoft Store, the installer performs file operations with elevated privileges (likely SYSTEM context) but fails to properly validate target paths. An attacker with low-privilege local access can create junction points or mount points that redirect the installer's file operations to arbitrary locations. When the installer attempts to delete or replace files, it follows these redirected paths, enabling deletion of protected system files or replacement with attacker-controlled content. The scope change (S:C) in the CVSS vector indicates the vulnerability breaks Windows security boundaries, allowing escape from the low-privilege user context to impact the underlying system integrity.
RemediationAI
Check for updated Norton Secure VPN version from Gen Digital addressing TALOS-2025-2276. Consult the Cisco Talos advisory at https://talosintelligence.com/vulnerability_reports/TALOS-2025-2276 for vendor response and patch timeline. Until a confirmed fix version is released, organizations should implement the following compensating controls: restrict Microsoft Store app installation permissions to administrative users only via Group Policy (prevents low-privilege users from triggering vulnerable installation); deploy Norton Secure VPN through enterprise MSI packages or direct downloads rather than Microsoft Store if the vulnerability is package-specific; monitor and alert on unexpected file system junction or mount point creation in user-writable directories during software installations using tools like Sysmon Event ID 26 (FileDeleteDetected); consider temporarily suspending Norton Secure VPN deployments via Microsoft Store until vendor confirmation of fixed version. Note that blocking Microsoft Store entirely may impact other business applications and requires careful testing.
More from same product – last 7 days
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Privilege escalation in Microsoft Entra ID enables remote unauthenticated attackers to bypass origin validation and gain
Share
External POC / Exploit Code
Leaving vuln.today