CVE-2025-20298

Published: Jun 2, 2025Modified: Jun 17, 2026

8.0

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.1 / Impact: 5.9

Source: psirt@cisco.com (Secondary)

Description

In Universal Forwarder for Windows versions below 9.4.2, 9.3.4, 9.2.6, and 9.1.9, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Universal Forwarder for Windows Installation directory (by default, C:\Program Files\SplunkUniversalForwarder). This lets non-administrator users on the machine access the directory and all its contents.

Affected (4)

Products: Splunk: Universal Forwarder

Splunk

1 product

Universal Forwarder

Configuration A

4 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Splunk Universal Forwarder	From 9.1.0 to 9.1.9
Splunk Universal Forwarder	From 9.2.0 to 9.2.6
Splunk Universal Forwarder	From 9.3.0 to 9.3.4
Splunk Universal Forwarder	From 9.4.0 to 9.4.2

Running on/with	Platform Versions
Microsoft Windows	All versions

Related CWEs

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References (1)

https://advisory.splunk.com/advisories/SVD-2025-0602

Source: psirt@cisco.com

Vendor Advisory

Timeline

No history available yet.