CVE-2025-4660

CRITICAL

Forescout SecureConnector Windows Agent - Named Pipe Remote Code Execution

Title source: manual

Exploitation Summary

EIP tracks 1 public exploit for CVE-2025-4660. PoCs published by NetSPI.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2025-4660, targeting Forescout SecureConnector for remote code execution. It includes a redirect script and a C2 implementation to interact with compromised agents.

Description

A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based attacker to connect without authentication. By interacting with this pipe, an attacker can redirect the agent to communicate with a rogue server that can issue commands via the SecureConnector Agent. This does not impact Linux or OSX Secure Connector.

Exploits (1)

nomisec WORKING POC 16 stars

by NetSPI · poc

https://github.com/NetSPI/CVE-2025-4660

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2025-4660, targeting Forescout SecureConnector for remote code execution. It includes a redirect script and a C2 implementation to interact with compromised agents.

Classification

Working Poc 95%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: Forescout SecureConnector

No auth needed

Prerequisites: Network access to the target Forescout SecureConnector · Ability to redirect agent traffic to attacker-controlled infrastructure

MITRE ATT&CK

T1059 - Command and Scripting Interpreter T1090 - Proxy

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Permissions Required

https://forescout.my.site.com/support/s/article/

Scores

CVSS v3 9.8

EPSS 0.0096

EPSS Percentile 56.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable yes

Technical Impact total

Details

CWE

CWE-276

Status published

Products (1)

forescout/secureconnector 11.1.02.1019 - 11.3.7

Published May 13, 2025

Tracked Since Feb 18, 2026