CVE-2025-41667

High

Published: 08 July 2025

Published

08 July 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0118 78.8th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-41667 is a high-severity Link Following (CWE-59) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 21.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068). What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-6 Least Privilege good match

prevent

Employs least privilege to prevent low-privileged accounts from having write access to critical files used by the arp-preinit script, blocking the prerequisite file replacement capability.

CM-5 Access Restrictions for Change good match

prevent

Restricts and authorizes changes to critical configuration files leveraged by the arp-preinit script, directly preventing low-privileged attackers from overwriting them.

SI-7 Software, Firmware, and Information Integrity good match

detect

Monitors the integrity of software, firmware, and configuration files including those used by arp-preinit, detecting unauthorized replacements by low-privileged attackers.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

Why these techniques?

CWE-59 link following in privileged arp-preinit script allows low-privileged file replacement to obtain arbitrary read/write/execute, directly enabling exploitation for privilege escalation to full device compromise.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.

Deeper analysisAI

CVE-2025-41667, published on 2025-07-08, is a CWE-59 vulnerability with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It affects systems utilizing the arp-preinit script, where a low-privileged remote attacker with file access can replace a critical file leveraged by the script.

A low-privileged remote attacker who already has file access on the target device can exploit this vulnerability by overwriting the critical file. Successful exploitation grants the attacker read, write, and execute permissions on any file on the device, enabling full compromise.

The advisory VDE-2025-054 from CERT VDE at https://certvde.com/en/advisories/VDE-2025-054 provides further details on mitigation and patches.