Description
In Pritunl Client before 1.3.4220.57, an administrator with access to /Applications can escalate privileges after uninstalling the product. Specifically, an administrator can insert a new file at the pathname of the removed pritunl-service file. This file then is executed by a LaunchDaemon as root.
References (1)
Core 1
Core References
Various Sources
https://forum.pritunl.com/t/pritunl-client-v1-3-4220-57/3183
Scores
CVSS v3
8.2
EPSS
0.0014
EPSS Percentile
3.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
total
Details
CWE
CWE-863
Status
published
Products (1)
Pritunl/Pritunl-Client
< 1.3.4220.57
Published
Apr 19, 2025
Tracked Since
Feb 18, 2026