Vulnerability · Published Dec 4, 2025 · Assigned by VulnCheck
CVE-2025-66575VeeVPN 1.6.1 - Unquoted Service Path Remote Code Execution
High 8.5
In plain English
A high-severity security flaw in VeeVPN from VeePN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).
Severity (CVSS 4.0)8.5High
Exploit odds (30 days)0.5%top 57.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.
Affected products (as reported)
Weakness: CWE-428 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P
References
- ExploitDB-52088 exploit
- VeePN Homepage product
- VeePN GitHub Repository product
- https://www.vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-execution third-party-advisory