CVE-2025-41667
Published: 08 July 2025
Summary
CVE-2025-41667 is a high-severity Link Following (CWE-59) vulnerability in Certvde (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and CM-5 (Access Restrictions for Change).
Deeper analysis
The vulnerability CVE-2025-41667 is a link-following flaw (CWE-59) in the arp-preinit script. A low-privileged remote attacker who already possesses file access on the device can replace a critical file referenced by the script, thereby obtaining read, write, and execute rights to any file on the system. The flaw is rated 8.8 on CVSS 3.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).
An attacker meeting the low-privilege and file-access preconditions can leverage the replaced file during arp-preinit execution to read or modify arbitrary files, write new content, or execute code with elevated rights. This grants full control over the device's file system without requiring further authentication or user interaction.
The single referenced advisory, VDE-2025-054, is the authoritative source for vendor-specific details. The associated EPSS score has remained flat at 0.0118 with no material rise since publication.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-20397
Vulnerability details
A low privileged remote attacker with file access can replace a critical file used by the arp-preinit script to get read, write and execute access to any file on the device.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CWE-59 link following in privileged arp-preinit script allows low-privileged file replacement to obtain arbitrary read/write/execute, directly enabling exploitation for privilege escalation to full device compromise.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Employs least privilege to prevent low-privileged accounts from having write access to critical files used by the arp-preinit script, blocking the prerequisite file replacement capability.
Restricts and authorizes changes to critical configuration files leveraged by the arp-preinit script, directly preventing low-privileged attackers from overwriting them.
Monitors the integrity of software, firmware, and configuration files including those used by arp-preinit, detecting unauthorized replacements by low-privileged attackers.