« Volver al listado

CVE-2025-6264

Estado: ModificadaMedia (5.5)—

Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.

The Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the "Investigator" role) to collect it from endpoints and update the configuration.

Leer descripción completaMostrar menos

This can lead to arbitrary command execution and endpoint takeover.

To successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the "Investigator' role).

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Rapid7 — Velociraptor

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-6264",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-6264",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-11-28T19:10:10.273114Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@rapid7.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.7,
        "exploitabilityScore": 1.3
      }
    ]
  },
  "affected": [
    {
      "source": "cve@rapid7.com",
      "affectedData": [
        {
          "repo": "https://github.com/Velocidex/velociraptor",
          "vendor": "Rapid7",
          "product": "Velociraptor",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "0.74.3",
              "versionType": "semver"
            }
          ],
          "platforms": [
            "Windows",
            "MacOS",
            "Linux"
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-06-20T03:15:27.893",
  "references": [
    {
      "url": "https://docs.velociraptor.app/announcements/advisories/cve-2025-6264/",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "cve@rapid7.com"
    },
    {
      "url": "https://blog.talosintelligence.com/velociraptor-leveraged-in-ransomware-attacks/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    },
    {
      "url": "https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@rapid7.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-276"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Velociraptor allows collection of VQL queries packaged into Artifacts from endpoints. These artifacts can be used to do anything and usually run with elevated permissions.  To limit access to some dangerous artifact, Velociraptor allows for those to require high permissions like EXECVE to launch.\n\nThe Admin.Client.UpdateClientConfig is an artifact used to update the client's configuration. This artifact did not enforce an additional required permission, allowing users with COLLECT_CLIENT permissions (normally given by the \"Investigator\" role) to collect it from endpoints and update the configuration. \n\nThis can lead to arbitrary command execution and endpoint takeover.\n\nTo successfully exploit this vulnerability the user must already have access to collect artifacts from the endpoint (i.e. have the COLLECT_CLIENT given typically by the \"Investigator' role)."
    },
    {
      "lang": "es",
      "value": "Velociraptor permite la recopilación de consultas VQL empaquetadas en artefactos desde los endpoints. Estos artefactos pueden usarse para cualquier función y suelen ejecutarse con permisos elevados. Para limitar el acceso a artefactos peligrosos, Velociraptor permite que estos requieran permisos elevados, como EXECVE, para su ejecución. Admin.Client.UpdateClientConfig es un artefacto utilizado para actualizar la configuración del cliente. Este artefacto no impuso un permiso adicional requerido, lo que permitió a los usuarios con permisos COLLECT_CLIENT (normalmente otorgados por el rol \"Investigador\") recopilarlos desde los endpoints y actualizar la configuración. Esto puede provocar la ejecución arbitraria de comandos y la toma de control del endpoint. Para explotar esta vulnerabilidad con éxito, el usuario debe tener acceso para recopilar artefactos desde el endpoint (es decir, tener el permiso COLLECT_CLIENT, normalmente otorgado por el rol \"Investigador\")."
    }
  ],
  "lastModified": "2026-06-17T10:01:29.023",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:rapid7:velociraptor:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9A8E9B27-890E-4DB0-8E79-8E900135B4AB",
              "versionEndExcluding": "0.74.3"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@rapid7.com"
}