CVE-2025-20387 Incorrect permissions assignment on Splunk Universal Forwarder for Windows during new installation or upgrade

🗓️ 03 Dec 2025 17:00:51Reported by ciscoType

CVE-2025-20387: New installs or upgrades of Splunk Universal Forwarder for Windows below 10.0.2, 9.4.6, 9.3.8, 9.2.10 may grant improper directory permissions.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerability of the monitoring and data collection application for Splunk Universal Forwarder arises from the improper assignment of permissions to critical resources. This allows a perpetrator to gain access to the installation directory (by default, C:\Program Files\SplunkUniversalForwarder) and all its contents.	24 Dec 202500:00	–	bdu_fstec
Circl	CVE-2025-20387	3 Dec 202521:56	–	circl
CNNVD	Splunk Universal Forwarder 安全漏洞	3 Dec 202500:00	–	cnnvd
CVE	CVE-2025-20387	3 Dec 202517:00	–	cve
EUVD	EUVD-2025-200997	3 Dec 202517:00	–	euvd
NCSC	Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform	8 Dec 202508:23	–	ncsc
NVD	CVE-2025-20387	3 Dec 202517:15	–	nvd
OSV	CVE-2025-20387	3 Dec 202517:15	–	osv
Positive Technologies	PT-2025-48959	3 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-20387	4 Dec 202517:16	–	redhatcve

[
  {
    "product": "Splunk Enterprise",
    "vendor": "Splunk",
    "versions": [
      {
        "version": "10.0",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "10.0.2"
      },
      {
        "version": "9.4",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.4.6"
      },
      {
        "version": "9.3",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.3.8"
      },
      {
        "version": "9.2",
        "status": "affected",
        "versionType": "custom",
        "lessThan": "9.2.10"
      }
    ]
  }
]

Source	Link
advisory	www.advisory.splunk.com/advisories/SVD-2025-1206

03 Dec 2025 17:00Current

CVSS 3.18

EPSS0.00488