Netskope Client EUVD-2025-210211

Exploitation requires a local administrator account on the targeted Windows endpoint - the CVSS 4.0 vector PR:H confirms this prerequisite. The attacker must be able to interact with the Windows Service Control Manager and registry on the local machine, both of which are accessible to local admins by OS design. The specific enabling condition is that Netskope Client's installer or service registration logic sets DACLs on the service object and registry keys that do not restrict admin-level modification, meaning the tamper protection boundary is not enforced at the OS permission layer. This condition is present by default on all affected versions; no non-default configuration is required to be vulnerable. Exploitation is strictly limited to local access - remote unauthenticated attackers cannot reach the service object or registry keys without first obtaining local admin privileges through other means. User interaction is not required once admin access is established. Limiting factors: the PR:H and AV:L constraints confine the attack surface entirely to insider threat actors or post-compromise scenarios where local admin has already been achieved.

The CVSS 4.0 score of 6.8 with vector AV:L/AC:L/AT:N/PR:H/UI:N reflects a local-only attack requiring high privileges, with high integrity and availability impact but no confidentiality impact. These metrics are internally consistent with the description: exploitation is strictly bounded to a local administrator on the affected Windows endpoint, not a remote or unauthenticated attacker. The AC:L rating indicates no special attack complexity beyond simply possessing local admin access, and the weak DACLs are present by default on all affected versions - no unusual configuration is required to be vulnerable. No EPSS data was provided, limiting probabilistic exploitation likelihood assessment. The vulnerability is not listed in CISA KEV and no public POC has been identified, meaning there is no confirmed evidence of active exploitation. Real-world priority should be elevated in environments handling sensitive data, regulated industries (finance, healthcare), or those with insider threat exposure, where disabling an endpoint DLP/CASB agent without detection is a meaningful attacker goal. For organizations with strict privilege management and separation of duties between IT admins and security tooling, the practical risk surface is reduced but not eliminated.

A malicious insider or attacker who has already elevated to local administrator on a Windows endpoint running Netskope Client below R138 uses standard Windows service management interfaces - such as the Service Control Manager via sc.exe or direct registry modification - to alter the NSClient service configuration or stop the service outright, actions that the weak DACLs permit rather than block. With tamper protection effectively bypassed, the Netskope agent stops enforcing DLP and CASB policies, allowing data exfiltration or policy violations to proceed undetected. No public POC exists, but the technique requires only routine Windows administration knowledge available to any IT professional.