Vulnerability · Published May 13, 2025 · Assigned by Forescout
CVE-2025-4660Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access
High 8.7
In plain English
A high-severity incorrect default permissions in SecureConnector from Forescout. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 68% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based attacker to connect without authentication. By interacting with this pipe, an attacker can redirect the agent to communicate with a rogue server that can issue commands via the SecureConnector Agent. This does not impact Linux or OSX Secure Connector.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Forescout | SecureConnector | 0 – through 11.3.6 |
Weakness: CWE-276 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/AU:Y/R:U/V:C/RE:M/U:Amber