CVE-2025-41666

High

Published: 08 July 2025

Published

08 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0118 78.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-41666 is a high-severity Link Following (CWE-59) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 21.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

CM-5 Access Restrictions for Change good match

prevent

Restricts access to make changes to critical system components like the watchdog file, preventing low-privileged attackers from replacing it.

AC-6 Least Privilege good match

prevent

Enforces least privilege to ensure low-privileged remote users lack write access to critical files used by the watchdog process.

SI-7 Software, Firmware, and Information Integrity good match

detect

Monitors the integrity of critical files such as the watchdog file to identify unauthorized replacements by attackers before initialization.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

Vulnerability enables low-privileged file replacement in watchdog component leading directly to privilege escalation and full device compromise (CWE-59 symlink/file resolution abuse).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A low privileged remote attacker with file access can replace a critical file used by the watchdog to get read, write and execute access to any file on the device after the watchdog has been initialized.

Deeper analysisAI

CVE-2025-41666, published on 2025-07-08 with a CVSSv3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and mapped to CWE-59 (Improper Link Resolution Before File Access), is a vulnerability affecting a critical file used by the watchdog component on a device. A low-privileged remote attacker with file access can replace this file, enabling escalation after the watchdog has been initialized.

The attack requires a low-privileged remote attacker who already has some file access on the device. By replacing the critical watchdog file, the attacker can achieve read, write, and execute access to any file on the device once the watchdog initializes, potentially leading to full compromise.

For mitigation details, refer to the advisory at https://certvde.com/en/advisories/VDE-2025-054.