Privilege Escalation in Rapid7 Velociraptor Admin.Client.UpdateClientConfig Artifact
CVE-2025-6264 is an incorrect default permissions vulnerability in Rapid7 Velociraptor affecting versions before 0.74.3 on Windows, macOS, and Linux. Velociraptor artifacts package VQL queries that can perform privileged actions on endpoints. The built-in artifact Admin.Client.UpdateClientConfig, which is used to update client configuration, failed to enforce an additional high-risk permission requirement such as EXECVE. As a result, a user who already has COLLECT_CLIENT permission—typically users in the Investigator role—can collect and invoke this artifact against endpoints and modify client configuration without the intended higher privilege gate. Because client configuration changes can be leveraged to run arbitrary commands or otherwise subvert agent behavior, successful exploitation can result in arbitrary command execution and full endpoint takeover.
Are you exposed to this one?
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
Impact, mitigation & remediation
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
Impact
What an attacker gets, and what they’ve been doing with it.
Mitigation
If you can’t patch tonight, do this now.
Remediation
Patch, then assume compromise.
Exploits
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a small operational helper for exploiting CVE-2025-6264 in Velociraptor. It is not a full exploit against the vulnerable artifact itself; instead, it automates attacker infrastructure setup needed to abuse the missing permission checks in Admin.Client.UpdateClientConfig. The repository contains two files: a README describing the vulnerability and attack flow, and a single Bash script, 2025-6264_setup.sh, which is the main entry point. The script installs Velociraptor v0.75.6 on a Linux host, generates a fresh server configuration, modifies the frontend bind address from 127.0.0.1 to 0.0.0.0, builds and installs the server .deb package, creates an administrator account with hardcoded credentials admin/admin, and extracts the Client section from the generated server config into a standalone client.config.yaml. It then replaces the default https://localhost:8000/ URL with the host's detected local IP so redirected clients will connect back to the attacker-controlled server. Operationally, the exploit capability is client redirection and takeover preparation: the generated YAML contains the CA certificate, nonce, and server URL needed to reconfigure vulnerable Velociraptor clients. Per the README, an attacker with Investigator-level access can insert this YAML into the vulnerable Admin.Client.UpdateClientConfig artifact, causing endpoints to rekey and reconnect to the malicious server. The script also supports a --client-only mode for environments where Velociraptor is already installed, in which case it only emits the client configuration. There is no standalone vulnerability trigger code in the repository; the actual abuse of the vulnerable artifact is assumed to be performed manually by the operator. Still, the repository clearly supports real exploitation by provisioning the malicious server and producing the exact configuration payload required for endpoint hijacking.
Affected products & vendors
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
Recent activity
37 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An incorrect default permissions issue in Rapid7's Velociraptor DFIR tool that could enable persistence in ransomware intrusions and was discussed in the context of tool abuse for remote access/C2.
A privilege escalation vulnerability affecting Velociraptor (noted in the context of attackers deploying an outdated agent version).
An incorrect default permissions vulnerability in Velociraptor that was removed from the KEV catalog due to insufficient evidence of exploitation.
A privilege escalation vulnerability affecting Velociraptor (noted specifically in version 0.73.4) that could be leveraged post-compromise to increase privileges and facilitate endpoint takeover or further actions.
The version that knows your environment.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.