CVE-2025-34290— Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation
Quick assessment
Affected
Versa Networks SASE Client for Windows
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Versa SASE Client for Windows是美国Versa公司的一个安全联网客户端。 Versa SASE Client for Windows 7.8.7版本至7.9.4版本存在安全漏洞，该漏洞源于审计日志导出功能存在本地权限提升漏洞，可能导致任意目录删除。
Possible ATT&CK Techniques 3 AI
T1055 · Process Injection T1068 · Exploitation for Privilege Escalation T1134 · Access Token Manipulation
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2025-34290
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Versa SASE Client for Windows < 7.9.5 Arbitrary Folder Deletion Leading to Local Privilege Escalation
Source: CVE Program / CVE List V5
Vulnerability Description
Versa SASE Client for Windows versions released between 7.8.7 and 7.9.4 contain a local privilege escalation vulnerability in the audit log export functionality. The client communicates user-controlled file paths to a privileged service, which performs file system operations without impersonating the requesting user. Due to improper privilege handling and a time-of-check time-of-use race condition combined with symbolic link and mount point manipulation, a local authenticated attacker can coerce the service into deleting arbitrary directories with SYSTEM privileges. This can be exploited to delete protected system folders such as C:\\Config.msi and subsequently achieve execution as NT AUTHORITY\\SYSTEM via MSI rollback techniques.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
带着不必要的权限执行
Source: CVE Program / CVE List V5
Vulnerability Title
Versa SASE Client for Windows 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Versa SASE Client for Windows是美国Versa公司的一个安全联网客户端。 Versa SASE Client for Windows 7.8.7版本至7.9.4版本存在安全漏洞，该漏洞源于审计日志导出功能存在本地权限提升漏洞，可能导致任意目录删除。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Versa Networks | SASE Client for Windows | 7.8.7 ~ 7.9.5 | - |
|
II. Public POCs for CVE-2025-34290
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-34290
请登录查看更多情报信息。
Other References for CVE-2025-34290 (2)
-
https://security-portal.versa-networks.com/emailbulletins/69421e33d03aafc8e5bdaf21 vendor-advisory patch
IV. Related Vulnerabilities
Same weakness: CWE-250
-
CVE-2026-104795
Insights-runtime-extractor: insights-runtime-extractor: cont -
CVE-2026-110150
Chrome <155.0.8059.79 Windows安装程序提权漏洞 -
CVE-2026-87709
Windows Host Guardian Service Tampering Vulnerability -
CVE-2026-65162
NVIDIA AIStore ETL API远程代码执行漏洞 -
CVE-2026-75621
IBM Aspera Enterprise Webapps Execution with Unnecessary Pri
V. Comments for CVE-2025-34290
No comments yet