CVE-2025-23010: An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which...

6.5 CVSS

Description

An Improper Link Resolution Before File Access ('Link Following') vulnerability in SonicWall NetExtender Windows (32 and 64 bit) client which allows an attacker to manipulate file paths.

Classification

CVE ID: CVE-2025-23010

CVSS Base Severity: MEDIUM

CVSS Base Score: 6.5

Problem Types

CWE-59 Improper Link Resolution Before File Access ('Link Following')

Affected Products

Vendor: SonicWall

Product: NetExtender

Exploit Prediction Scoring System (EPSS)

EPSS Score: 0.01% (probability of being exploited)

EPSS Percentile: 0.78% (scored less or equal to compared to others)

EPSS Date: 2025-04-20 (when was this score calculated)

Stakeholder-Specific Vulnerability Categorization (SSVC)

SSVC Exploitation: none

SSVC Technical Impact: partial

SSVC Automatable: false

References

https://nvd.nist.gov/vuln/detail/CVE-2025-23010
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2025-0006

Timeline