Veepn
Monthly
Privilege escalation to LocalSystem is possible on Windows hosts running VeePN 1.6.1 due to an unquoted service path in VeePNService (CWE-428). A local attacker who can write an executable into a directory preceding the service binary in the unquoted path can have it executed with SYSTEM privileges when the service restarts or the machine reboots; public exploit code exists, though EPSS is low at 0.13% and CISA KEV does not list it. While the original description mentions remote attackers, the independent assessment confirms this is a local-only escalation requiring local access to the host and write permissions in the service path, rated CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Privilege escalation to LocalSystem is possible on Windows hosts running VeePN 1.6.1 due to an unquoted service path in VeePNService (CWE-428). A local attacker who can write an executable into a directory preceding the service binary in the unquoted path can have it executed with SYSTEM privileges when the service restarts or the machine reboots; public exploit code exists, though EPSS is low at 0.13% and CISA KEV does not list it. While the original description mentions remote attackers, the independent assessment confirms this is a local-only escalation requiring local access to the host and write permissions in the service path, rated CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.