CVE-2025-41255CWE-266

Cyberduck and Mountain Duck - Improper Certificate Store Handling

High · published June 25, 2025

CVSS v3.1
8.0
EPSS
0%
Percentile
7.9
In the wild
Unconfirmed
What it is

Cyberduck and Mountain Duck improperly handle TLS certificate pinning for untrusted certificates (e.g., self-signed), unnecessarily installing it to the Windows Certificate Store of the current user without any restrictions.

This issue affects Cyberduck through 9.1.6 and Mountain Duck through 4.17.5.

The record
Technical detail
CVSS v3.1
8.0 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00187 · 7.9th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2025-06-25T09:21Z
EPSS history
Timeline
  • 25 JUN 09:21Z
    Cyberduck and Mountain Duck - Improper Certificate Store Handling
    cvelistv5