CVE-2025-43711 Overview
CVE-2025-43711 is a local privilege escalation vulnerability in Tunnelblick, an open-source OpenVPN client for macOS. The flaw affects Tunnelblick versions 3.5beta06 through versions prior to 7.0 when the application has been incompletely uninstalled. Attackers can execute arbitrary code as root on the next system boot by placing a crafted Tunnelblick.app file into /Applications. The root cause is an incomplete cleanup of privileged components left behind after uninstallation, classified under [CWE-459] (Incomplete Cleanup).
Critical Impact
Successful exploitation yields code execution as root, granting full control of the affected macOS system on next boot.
Affected Products
- Tunnelblick 3.5beta06 and later 3.x releases
- Tunnelblick versions prior to 7.0
- macOS systems where Tunnelblick was previously installed and incompletely uninstalled
Discovery Timeline
- 2025-07-05 - CVE-2025-43711 published to NVD
- 2026-04-15 - Last updated in NVD database
Technical Details for CVE-2025-43711
Vulnerability Analysis
Tunnelblick installs privileged helper components and launch daemons that run as root to manage VPN connections on macOS. When a user removes the application without invoking the official uninstaller, residual privileged components remain registered on the system. These leftover components continue to reference the expected application bundle path at /Applications/Tunnelblick.app.
The vulnerability is categorized as Incomplete Cleanup [CWE-459]. An attacker who can place a file in /Applications can supply a malicious bundle that the residual privileged components will load and execute at boot. Because the residual helper runs as root, the attacker-supplied payload inherits root privileges. The issue is not exploitable on systems that never had Tunnelblick installed, or on systems where the official uninstaller was used.
Root Cause
The uninstallation process in versions from 3.5beta06 up to 7.0 does not remove all privileged components, including launch daemons and helper tools. These components persist across reboots and are not bound to a cryptographic identity check sufficient to prevent loading of an attacker-supplied replacement bundle.
Attack Vector
Exploitation requires local access to drop a crafted Tunnelblick.app into /Applications, plus a system reboot. The high attack complexity reflects the precondition that Tunnelblick must have been previously installed and incompletely removed. No user interaction with the malicious bundle is required after placement, since execution is triggered by privileged components at boot.
No public proof-of-concept code is available. See the Tunnelblick CVE-2025-43711 Advisory for vendor technical details.
Detection Methods for CVE-2025-43711
Indicators of Compromise
- Presence of Tunnelblick launch daemons or helper tools under /Library/LaunchDaemons/ or /Library/Application Support/Tunnelblick/ on systems where /Applications/Tunnelblick.app is absent or unexpected
- An unsigned, modified, or unexpectedly recent Tunnelblick.app bundle in /Applications on a host where Tunnelblick is not in active use
- Unexpected root-owned processes spawned at boot referencing Tunnelblick binaries
Detection Strategies
- Audit endpoints for residual Tunnelblick privileged components after user-initiated uninstallation
- Compare code signatures of any Tunnelblick.app bundle against the official developer signing identity
- Alert on file creation events in /Applications involving Tunnelblick.app on hosts that do not currently run the application
Monitoring Recommendations
- Monitor macOS unified logs for launchd loading Tunnelblick helper daemons at boot
- Track process creation events for Tunnelblick binaries executing as root outside expected VPN session activity
- Inventory installed and previously installed VPN clients across the macOS fleet to identify exposed hosts
How to Mitigate CVE-2025-43711
Immediate Actions Required
- Upgrade Tunnelblick to version 7.0 or later on all macOS endpoints
- On systems where Tunnelblick was previously removed without the official uninstaller, run the official uninstaller from a clean Tunnelblick 7.0 installation
- Verify that no Tunnelblick.app bundle remains in /Applications on hosts that do not require the client
Patch Information
Tunnelblick 7.0 resolves the incomplete cleanup issue. Download the fixed release from the Tunnelblick Downloads Page and follow the vendor advisory at Tunnelblick CVE-2025-43711 Advisory.
Workarounds
- Remove all residual Tunnelblick launch daemons, helper tools, and support directories using the official uninstaller from Tunnelblick 7.0
- Restrict write access to /Applications to administrative users only via macOS file system permissions and MDM policy
- Enforce code signature verification policies that block execution of unsigned or improperly signed application bundles
# Verify Tunnelblick removal and code signature on macOS
ls -la /Applications/Tunnelblick.app 2>/dev/null
ls -la /Library/LaunchDaemons/ | grep -i tunnelblick
ls -la "/Library/Application Support/Tunnelblick" 2>/dev/null
codesign -dv --verbose=4 /Applications/Tunnelblick.app 2>&1 | grep -E 'Authority|TeamIdentifier'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
