CVE-2025-0309

Published Aug 14, 2025

Last updated 4 months ago

Netskope Client

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-0309 affects the Netskope Client. It involves insufficient validation on the server connection endpoint, which allows local users to elevate privileges on the system. The insufficient validation allows the Netskope Client to connect to other servers using Public Signed CA TLS certificates. By sending specially crafted responses, attackers can elevate their privileges.

Description: An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges.
Source: psirt@netskope.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 6
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: MEDIUM

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-295

Hype score: Not currently trending

References