« Back to list

CVE-2025-9142

Status: DeferredHigh (7.5)—

A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

Acceso local con UI:R requiere interacción del usuario (abrir/ejecutar algo preparado). Manipulación de archivos fuera del directorio previsto (CWE-22) permite escritura/borrado; T1565.001 es impacto principal por modificación maliciosa.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Restrict File and Directory PermissionsRemote Data StorageEncrypt Sensitive InformationApplication Isolation and SandboxingExploit ProtectionUpdate Software

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Harmony — Sase Windows ClientAI

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2025-9142",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-9142",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-14T14:49:40.165312Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@checkpoint.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.5,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 0.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@checkpoint.com",
      "affectedData": [
        {
          "vendor": "checkpoint",
          "product": "Hramony SASE",
          "versions": [
            {
              "status": "affected",
              "version": "Check Point Harmony SASE Windows Agent versions prior to 12.2"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-01-14T15:16:04.333",
  "references": [
    {
      "url": "https://support.checkpoint.com/results/sk/sk184557",
      "source": "cve@checkpoint.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@checkpoint.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A local user can trigger Harmony SASE Windows client to write or delete files outside the intended certificate working directory."
    },
    {
      "lang": "es",
      "value": "Un usuario local puede desencadenar que el cliente de Harmony SASE para Windows escriba o elimine archivos fuera del directorio de trabajo de certificados previsto."
    }
  ],
  "lastModified": "2026-06-17T10:08:24.353",
  "sourceIdentifier": "cve@checkpoint.com"
}