{
    "dataType": "CVE_RECORD",
    "dataVersion": "5.1",
    "cveMetadata": {
        "cveId": "CVE-2025-0309",
        "assignerOrgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc",
        "state": "PUBLISHED",
        "assignerShortName": "Netskope",
        "dateReserved": "2025-01-07T14:23:56.898Z",
        "datePublished": "2025-08-14T04:35:15.287Z",
        "dateUpdated": "2025-08-15T12:58:27.857Z"
    },
    "containers": {
        "cna": {
            "affected": [
                {
                    "defaultStatus": "unaffected",
                    "product": "Netskope Client",
                    "vendor": "Netskope",
                    "versions": [
                        {
                            "lessThan": "129.0.0",
                            "status": "affected",
                            "version": "0",
                            "versionType": "custom"
                        }
                    ]
                }
            ],
            "credits": [
                {
                    "lang": "en",
                    "type": "reporter",
                    "value": "Richard Warren"
                }
            ],
            "descriptions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges."
                        }
                    ],
                    "value": "An insufficient validation on the server connection endpoint in Netskope Client allows local users to elevate privileges on the system. The insufficient validation allows Netskope Client to connect to any other server with Public Signed CA TLS certificates and send specially crafted responses to elevate privileges."
                }
            ],
            "metrics": [
                {
                    "cvssV4_0": {
                        "Automatable": "NOT_DEFINED",
                        "Recovery": "NOT_DEFINED",
                        "Safety": "NOT_DEFINED",
                        "attackComplexity": "LOW",
                        "attackRequirements": "PRESENT",
                        "attackVector": "PHYSICAL",
                        "baseScore": 6,
                        "baseSeverity": "MEDIUM",
                        "privilegesRequired": "LOW",
                        "providerUrgency": "NOT_DEFINED",
                        "subAvailabilityImpact": "HIGH",
                        "subConfidentialityImpact": "HIGH",
                        "subIntegrityImpact": "HIGH",
                        "userInteraction": "NONE",
                        "valueDensity": "NOT_DEFINED",
                        "vectorString": "CVSS:4.0/AV:P/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:H/SC:H/SI:H/SA:H",
                        "version": "4.0",
                        "vulnAvailabilityImpact": "HIGH",
                        "vulnConfidentialityImpact": "NONE",
                        "vulnIntegrityImpact": "LOW",
                        "vulnerabilityResponseEffort": "NOT_DEFINED"
                    },
                    "format": "CVSS",
                    "scenarios": [
                        {
                            "lang": "en",
                            "value": "GENERAL"
                        }
                    ]
                }
            ],
            "providerMetadata": {
                "orgId": "bf992f6a-e49d-4e94-9479-c4cff32c62bc",
                "shortName": "Netskope",
                "dateUpdated": "2025-08-14T04:35:15.287Z"
            },
            "references": [
                {
                    "tags": [
                        "third-party-advisory"
                    ],
                    "url": "https://blog.amberwolf.com/blog/2025/august/breaking-into-your-network-zer0-effort/"
                },
                {
                    "tags": [
                        "vendor-advisory"
                    ],
                    "url": "https://www.netskope.com/company/security-compliance-and-assurance/security-advisories-and-disclosures/netskope-security-advisory-nskpsa-2025-002"
                }
            ],
            "solutions": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "Update the Netskope Client to version 129.0.0 or newer"
                        }
                    ],
                    "value": "Update the Netskope Client to version 129.0.0 or newer"
                }
            ],
            "source": {
                "advisory": "NSKPSA-2025-002",
                "discovery": "EXTERNAL"
            },
            "title": "Netskope Client Local Elevation of Privileges",
            "workarounds": [
                {
                    "lang": "en",
                    "supportingMedia": [
                        {
                            "base64": false,
                            "type": "text/html",
                            "value": "There are multiple configurations which can mitigate and reduce potential exposure: <br><ul><li>Block connection/access to any new domain or URLs to NS Client apart from goskope.com</li><ul><li>Use EDR tools to monitor connections from NS Client to any random domains and block it</li></ul><li>\n\nMonitor for addition of any self signed certificates in operating system certificate store\n\n<br></li><li>Monitor the status of NS Client</li></ul><br>"
                        }
                    ],
                    "value": "There are multiple configurations which can mitigate and reduce potential exposure: \n  *  Block connection/access to any new domain or URLs to NS Client apart from goskope.com\n  *  Use EDR tools to monitor connections from NS Client to any random domains and block it\n\n\n  *  \n\nMonitor for addition of any self signed certificates in operating system certificate store\n\n\n\n  *  Monitor the status of NS Client"
                }
            ],
            "x_generator": {
                "engine": "Vulnogram 0.2.0"
            }
        },
        "adp": [
            {
                "problemTypes": [
                    {
                        "descriptions": [
                            {
                                "type": "CWE",
                                "cweId": "CWE-295",
                                "lang": "en",
                                "description": "CWE-295 Improper Certificate Validation"
                            }
                        ]
                    }
                ],
                "metrics": [
                    {
                        "other": {
                            "type": "ssvc",
                            "content": {
                                "timestamp": "2025-08-15T12:26:51.060701Z",
                                "id": "CVE-2025-0309",
                                "options": [
                                    {
                                        "Exploitation": "none"
                                    },
                                    {
                                        "Automatable": "no"
                                    },
                                    {
                                        "Technical Impact": "partial"
                                    }
                                ],
                                "role": "CISA Coordinator",
                                "version": "2.0.3"
                            }
                        }
                    }
                ],
                "title": "CISA ADP Vulnrichment",
                "providerMetadata": {
                    "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
                    "shortName": "CISA-ADP",
                    "dateUpdated": "2025-08-15T12:58:27.857Z"
                }
            }
        ]
    }
}