VeePN CVE-2025-66575

Requires local access to a Windows host running the VeeVPN 1.6.1 VeePNService, which is installed with an unquoted binary path. The attacker must be able to write an executable into an intervening directory of that path (e.g. C:\Program.exe or a writable install subdirectory) and must be able to cause the service to restart or the machine to reboot for the payload to run as LocalSystem. Limiting factors: this is local-only (AV:L) - there is no remote/network exploitation despite the description's wording; success depends on the service path containing a directory writable by the attacker's privilege level, and on a service-start/reboot event occurring.

This is a classic Windows unquoted service path local privilege escalation (CWE-428) in VeePNService, not a remote code-execution flaw despite the description's 'remote attackers' phrasing. The CVSS 4.0 vector itself confirms local access (AV:L), directly contradicting the word 'remote' - the real risk is a low-privileged local user escalating to LocalSystem, so the network-implying language should be disregarded. Signals point to LOW real-world urgency: EPSS is only 0.13% (33rd percentile), there is no CISA KEV listing, and the SSVC exploitation state is at most 'proof-of-concept' (E:P in the vector). A public exploit does exist (Exploit-DB 52088), which raises the practical likelihood for anyone who already has a foothold on a machine running VeeVPN, but unquoted-service-path bugs are only exploitable when the attacker can write to an intervening path segment and trigger a service restart/reboot - a meaningful gating condition. Net: a legitimate but low-priority local privesc, weaponizable post-compromise rather than a mass-exploitation threat; the 8.5 CVSS 4.0 base overstates urgency because it does not reflect the required local foothold and writable-path precondition.

A low-privileged user (or malware already running as a standard user) on a Windows host with VeeVPN 1.6.1 installed places a malicious executable (e.g. C:\Program.exe) along the unquoted VeePNService binary path. On the next service start or system reboot, the Service Control Manager launches the attacker's binary as LocalSystem, yielding full SYSTEM privileges. A public proof-of-concept is available on Exploit-DB (52088).