Vulnerability · Published Jun 26, 2025 · Assigned by VulnCheck
CVE-2025-34047Leadsec VPN Path Traversal Arbitrary File Read
High 8.7
In plain English
A high-severity path traversal in Leadsec SSL VPN from Beijing NetGuard Nebula Information Technology Co., Ltd.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).
Official description
A path traversal vulnerability exists in the Leadsec SSL VPN (formerly Lenovo NetGuard), allowing unauthenticated attackers to read arbitrary files on the underlying system via the ostype parameter in the /vpn/user/download/client endpoint. This flaw arises from insufficient input sanitation, enabling traversal sequences to escape the intended directory and access sensitive files. Exploitation evidence was observed by the Shadowserver Foundation on 2025-02-05 UTC.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Beijing NetGuard Nebula Information Technology Co., Ltd. | Leadsec SSL VPN | 0 |
Weakness: CWE-22, CWE-20 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
References
- https://www.cnvd.org.cn/flaw/show/CNVD-2021-64035 third-party-advisory
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cnvd/2021/CNVD-2021-64035.yaml exploit
- https://www.leadsec.com.cn/ product
- https://vulncheck.com/advisories/leadsec-vpn-path-traversal-file-read third-party-advisory