CVE-2025-25565
Published: 12 March 2025
Summary
CVE-2025-25565 is a critical-severity Classic Buffer Overflow (CWE-120) vulnerability in Softether Vpn. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 42.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-25565 is a buffer overflow vulnerability (CWE-120) affecting SoftEther VPN version 5.02.5187, specifically in the Command.c source file through the PtMakeCert and PtMakeCert2048 functions. Published on 2025-03-12, it has been assigned a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity with potential for high impacts on confidentiality, integrity, and availability.
The vulnerability can be triggered by providing overly long input strings to the affected functions, leading to a buffer overflow. While the CVSS vector suggests network-accessible exploitation without privileges or user interaction, the supplier disputes its validity as a remotely exploitable issue, asserting that it only enables a local user to attack themselves by entering a long string directly on the command line.
Advisories referenced in the CVE include a supplier statement at https://filecenter.softether-upload.com/d/250715_001_79538/CVE-2025-25565.pdf and researcher details at https://lzydry.github.io/CVE-2025-25565/, which highlight the disputed self-affecting nature but do not specify patches or mitigations beyond the supplier's position that it does not qualify as a vulnerability warranting fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-6772
Vulnerability details
SoftEther VPN 5.02.5187 is vulnerable to Buffer Overflow in the Command.c file via the PtMakeCert and PtMakeCert2048 functions. NOTE: the Supplier disputes this because the behavior only allows a user to attack himself by typing a long string on a…
more
command line.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Buffer overflow in local command-line certificate functions (PtMakeCert/PtMakeCert2048) can be exploited for arbitrary code execution within the client management tool, mapping to client-side exploitation despite disputed remote reachability.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents buffer overflows in PtMakeCert and PtMakeCert2048 by validating lengths and formats of command-line input strings before processing.
Deploys memory protections like stack canaries, ASLR, and DEP to block exploitation of buffer overflows even if long inputs are processed.
Mandates identification, assessment, and timely remediation of flaws such as CVE-2025-25565 through patching SoftEther VPN.