Security readout for executives and security teams
Plain-English summary
On Windows systems where WatchGuard Mobile VPN with SSL Client 11.0 was installed outside its standard directory, weak directory permissions may let an authenticated, low-privilege local attacker gain SYSTEM rights. This is not a remote entry point, but successful escalation could give extensive control over an endpoint.
Executive priority
Treat this as a targeted endpoint-hardening priority rather than an internet-wide emergency. Promptly inventory installation paths and address confirmed exposures, especially on shared systems or sensitive workstations. Urgency increases when an attacker may already possess local credentials or endpoint access.
Technical view
CVE-2025-2781 is a CWE-276 permissions weakness affecting non-standard installation directories. Exploitation requires local access and low privileges, has low complexity, and requires no user interaction. The CVSS 4.0 score is 6.3. The supplied sources do not establish the exact vulnerable build range or a patched version beyond identifying version 11.0.
Likely exposure
Exposure is limited to Windows endpoints running WatchGuard Mobile VPN with SSL Client 11.0 in a non-default installation directory. Systems using the default directory are not within the described vulnerable condition. Shared endpoints and systems where less-trusted users have local accounts deserve earlier review.
Exploitation context
The attacker must already be authenticated locally, so this vulnerability does not independently provide remote access. It can elevate an existing foothold to SYSTEM. The CVE is not listed in KEV, and the supplied sources provide no evidence of active exploitation.
Researcher notes
The CVSS 4.0 vector indicates local access, low complexity, low privileges, and no user interaction. The vulnerable component impact includes low integrity impact, while subsequent system impacts are rated high. The bundle does not provide exploit mechanics, active-exploitation evidence, a precise build range, or a confirmed fixed release.
Mitigation direction
- Consult WatchGuard's advisory for supported remediation and fixed-version guidance.
- Prioritize affected endpoints where untrusted or multiple users have local access.
- Restrict unnecessary local accounts and privileges while remediation is pending.
- Monitor affected directories and privileged activity for unexpected changes.
Validation and detection
- Inventory Windows endpoints running WatchGuard Mobile VPN with SSL Client 11.0.
- Identify installations located outside the product's default directory.
- Review those directory permissions for unintended modification access by low-privilege users.
- Confirm remediation and supported versions against WatchGuard's advisory.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-276: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupPrivilege behavior lookup
The CVE wording references privilege impact, so privilege escalation and authorization behavior review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2025-2781 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H——WatchGuardVulnerability scoring details
Base CVSS 4.0 score
6.3MediumVector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://psirt.watchguard.com/CVE-2025-2781CVE reference, WatchGuard · vendor-advisory
- https://www.watchguard.com/wgrd-psirt/advisory/wgsa-2025-00004CVE reference, WatchGuard
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Default Permissions
Incorrect Default Permissions represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.