What’s Vulnerable › Vulnerabilities

CVE-2025-66575: VeeVPN 1.6.1 - Unquoted Service Path Remote Code Execution

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-12-04 · updated 2026-09-25
• Weakness: CWE-428

Description

VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.

Affected products

• Veepn: 1.6.1

References

• https://github.com/veepn/veepn
• https://veepn.com/
• https://www.exploit-db.com/exploits/52088
• https://www.vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-execution
• https://www.exploit-db.com/exploits/52088

Get alerted when CVE-2025-66575 or the next vulnerability affects your stack