CVE-2025-25565

CriticalPublic PoC

Published: 12 March 2025

Published

12 March 2025

Modified

19 July 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0020 41.8th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-25565 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Softether Vpn. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 41.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-10 Information Input Validation good match

prevent

Directly prevents buffer overflows in PtMakeCert and PtMakeCert2048 by validating lengths and formats of command-line input strings before processing.

SI-16 Memory Protection good match

prevent

Deploys memory protections like stack canaries, ASLR, and DEP to block exploitation of buffer overflows even if long inputs are processed.

SI-2 Flaw Remediation good match

prevent

Mandates identification, assessment, and timely remediation of flaws such as CVE-2025-25565 through patching SoftEther VPN.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution

Adversaries may exploit software vulnerabilities in client applications to execute code.

attack.mitre.org →

Why these techniques?

Buffer overflow in local command-line certificate functions (PtMakeCert/PtMakeCert2048) can be exploited for arbitrary code execution within the client management tool, mapping to client-side exploitation despite disputed remote reachability.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

NVD Description

SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a…

command line.

Deeper analysisAI

CVE-2025-25565 is a buffer overflow vulnerability (CWE-120) affecting SoftEther VPN version 5.02.5187, specifically in the Command.c source file through the PtMakeCert and PtMakeCert2048 functions. Published on 2025-03-12, it has been assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with potential for high impacts on confidentiality, integrity, and availability.

The vulnerability can be triggered by providing overly long input strings to the affected functions, leading to a buffer overflow. While the CVSS vector suggests network-accessible exploitation without privileges or user interaction, the supplier disputes its validity as a remotely exploitable issue, asserting that it only enables a local user to attack themselves by entering a long string directly on the command line.

Advisories referenced in the CVE include a supplier statement at https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25565.pdf and researcher details at https://lzydry.github.io/CVE-2025-25565/, which highlight the disputed self-affecting nature but do not specify patches or mitigations beyond the supplier's position that it does not qualify as a vulnerability warranting fixes.