CVE-2025-1683 HIGH

CVE-2025-1683: Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion

Vendor 1E
Product 1E Client
Weakness CWE-59
Published March 12, 2025
Last update June 18, 2025
View on NVD All CVEs

CVSS base score

7.8/10
Attack vector Local
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links.

Key dates

02Disclosure timeline

March 12, 2025 CVE published
June 18, 2025 Record updated