A vulnerability in NextVPN 4.10 allows local users to escalate privileges to SYSTEM or Administrator levels by modifying application binaries due to insecure file permissions.

The application is installed with insecure file permissions that grant standard local users full access rights to executable files. An attacker can replace these legitimate binaries with malicious code, which will be executed with elevated system privileges.

Successful exploitation of this vulnerability allows a local attacker to gain full control over the host machine. This poses a severe risk to data confidentiality, integrity, and availability, as the attacker can perform any action with SYSTEM or Administrator privileges. Given the CVSS score of 7.8, this represents a high-severity risk for any environment where untrusted local users have access to a machine running the affected software.

Immediate Action: There is currently no official patch available. Administrators should restrict access to the application installation directory and prevent standard users from modifying files within the NextVPN folder.

Proactive Monitoring: Monitor system logs for unauthorized changes to program files or the execution of unexpected binaries within the application directory.

Compensating Controls: Implement strict Application Whitelisting or Endpoint Detection and Response (EDR) solutions to prevent the execution of unauthorized or tampered binaries.

Public Exploit Available: Yes, a proof-of-concept exploit is available via the Exploit Database (EDB-ID: 47831).

Due to the lack of an official patch and the availability of a public proof-of-concept, users are urged to treat this vulnerability with high priority. Organizations must ensure that least-privilege principles are applied to the local filesystem to prevent local users from modifying application binaries. If the software is not mission-critical, consider deactivating or uninstalling it until a vendor-supplied security update is released.