CVE-2025-41255
Last modified
CVE-2025-41255 is a high-severity vulnerability rated 8/10 on the CVSS scale. Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions. This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-41255?
How severe is CVE-2025-41255?
How do I fix CVE-2025-41255?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-4125Delta Electronics ISPSoft version 3.20 is vulnerable to an O…9.8
- CVE-2025-41250VMware vCenter contains an SMTP header injection vulnerabili…8.5
- CVE-2025-41251VMware NSX contains a weak password recovery mechanism vulne…8.1
- CVE-2025-41252Description: VMware NSX contains a username enumeration vuln…7.5
- CVE-2025-41253The following versions of Spring Cloud Gateway Server Webflu…7.5
- CVE-2025-41254STOMP over WebSocket applications may be vulnerable to a sec…4.3
- CVE-2025-41256Cyberduck and Mountain Duck improper handle TLS certificate …7.4
- CVE-2025-41257Suprema’s BioStar 2 in version 2.9.11.6 allows users to set …4.8
- CVE-2025-41258LibreChat version 0.8.1-rc2 uses the same JWT secret for the…8
- CVE-2025-41259SWUpdate before 2026.05 is affected by a time-of-check time-…7.3
- CVE-2025-4126The EG-Series plugin for WordPress is vulnerable to Stored C…6.4
- CVE-2025-41265Nozomi Networks Labs identified a CWE-78: Improper Neutraliz…7.2
Are you affected by CVE-2025-41255?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST