CVE-2025-20298

Incorrect permission assignment on Universal Forwarder for Windows during new installation or upgrade

CVSS 8 HIGHEPSS 0.2%CWE-732

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 8EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

02 Jun 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected products

Splunk · Splunk/UniversalForwarder for Windows

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://advisory.splunk.com/advisories/SVD-2025-0602