# CVE-2025-66575

## Summary

- **CVE ID:** CVE-2025-66575
- **Severity:** HIGH
- **CVSS Score:** 8.5 (CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P)
- **CWE:** CWE-428
- **Published:** Dec 4, 2025
- **Last Modified:** Mar 13, 2026

## Description

VeeVPN 1.6.1 contains an unquoted service path vulnerability in the VeePNService that allows remote attackers to execute code during startup or reboot with escalated privileges. Attackers can exploit this by providing a malicious service name, allowing them to inject commands and run as LocalSystem.

## Affected Products

- VeePN — VeeVPN (1.6.1)

## References

- [CNA](https://www.exploit-db.com/exploits/52088)
- [CNA](https://veepn.com/)
- [CNA](https://github.com/veepn/veepn)
- [CNA](https://www.vulncheck.com/advisories/veevpn-161-unquoted-service-path-remote-code-execution)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.46%
- **EPSS Percentile:** 38.5

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._