Improper Access Controls in Cisco ThousandEyes Endpoint Agent for Windows

CVE-2025-20259

What is CVE-2025-20259?

The Cisco ThousandEyes Endpoint Agent for Windows has vulnerabilities during its update process that could be exploited by an authenticated local attacker. These vulnerabilities stem from inadequate access controls on local file system files. An attacker can use symbolic links to manipulate agent upgrades, leading to unauthorized deletion of crucial files. Successful exploitation poses significant risks by allowing the deletion of arbitrary files from the device's file system.

References