Norton Secure VPN EUVD-2025-209612

Exploitation requires Norton Secure VPN to be installed via the Microsoft Store distribution channel (not direct download or enterprise MSI). Attacker must have authenticated low-privilege local access to the Windows system (PR:L). Attack window exists during active installation or repair operations when the installer runs with elevated privileges. Attacker must create file system junction points or mount points in predictable locations before or during installation, requiring knowledge of the installer's file operation sequence. No user interaction required beyond initiating the installation (UI:N). Vulnerability does NOT affect systems where Norton Secure VPN is already installed and not being updated/repaired, or where Microsoft Store installations are administratively blocked. The local-only attack vector (AV:L) means remote exploitation is not possible without prior system compromise.

Despite the CVSS 8.8 (High) score, real-world risk depends heavily on deployment context. The local attack vector (AV:L) with low-privilege requirement (PR:L) means attackers need existing access to a Windows system with Norton Secure VPN installation capability. The low attack complexity (AC:L) and no user interaction (UI:N) make this readily exploitable during installation windows. However, exploitation requires triggering a fresh installation or repair, limiting opportunistic attacks. EPSS data not available but likely moderate given the narrow attack window. Not listed in CISA KEV, indicating no confirmed widespread exploitation. Primary risk scenario: attackers with initial foothold on corporate endpoints could exploit this during software deployment cycles to gain SYSTEM privileges for persistence and lateral movement. Risk is amplified in environments with automated software deployment or where users frequently reinstall VPN clients. Lower risk in locked-down environments where software installation is centrally controlled without local user involvement.

An attacker with standard user access to a Windows corporate laptop creates strategically placed NTFS junction points in their user profile before initiating Norton Secure VPN installation from Microsoft Store. During the installation, the elevated installer follows these junctions and deletes or replaces critical system files such as utilman.exe or sethc.exe with attacker-controlled binaries. On next system boot or login screen, the attacker triggers these accessibility features to execute code as SYSTEM, establishing persistent administrative access without triggering UAC prompts.