CVE-2025-66575

8.5 highEPSS 0.5%

High (8.5) in veepn veepn. EPSS 0.5% chance of exploitation in the next 30 days.

VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.

Severity

CVSS 4.0

8.5 high

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P

CVSS 3.1

7.8 high

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 39% of CVEs (scores of 2026-10-31)
CWE: CWE-428
Published: 2025-12-04
Modified: 2026-09-25
Record from: the NVD, synced 2026-10-19

Affected

veepn:veepn

References

https://github.com/veepn/veepn
https://veepn.com/
https://www.exploit-db.com/exploits/52088
https://www.vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-execution
https://www.exploit-db.com/exploits/52088

Check your stack JSON