Skip to content
OpenAdvisories
High · 8.7 Public exploit CVE-2025-4660 EUVD-2025-14480GHSA-86pc-jx85-mvrw

Remote Code Execution in Windows Secure Connector/ HPS Inspection Engine via Insecure Named Pipe Access

Published May 13, 2025 · Updated Aug 21, 2025 · Assigned by Forescout

Vendor: Forescout Product: SecureConnector

Description

A remote code execution vulnerability exists in the Windows agent component of SecureConnector due to improper access controls on a named pipe. The pipe is accessible to the Everyone group and does not restrict remote connections, allowing any network-based attacker to connect without authentication. By interacting with this pipe, an attacker can redirect the agent to communicate with a rogue server that can issue commands via the SecureConnector Agent. 

This does not impact Linux or OSX Secure Connector.

Affected products

VendorProductAffectedFixed
Forescout SecureConnector ≤ 11.3.6 11.3.7

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • NetSPI/CVE-2025-4660 ★ 16 · Jul 3, 2025

    PoC for CVE-2025-4660 demonstrating exploitation of the Forescout SecureConnector on Windows

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References