1E Client vulnerabilities

Latest 1E Client CVEs

Newest publication first

1. CVE-2025-1683 Symbolic Link Exploit in 1E Client's - Nomad module allows Arbitrary File Deletion

   Published 2025-03-12

   High·CVSS 7.8 EPSS 0.22%

   Improper link resolution before file access in the Nomad module of the 1E Client, in versions prior to 25.3, enables an attacker with local unprivileged access on a Windows system to delete arbitrary files on the device by exploiting symbolic links.

2. CVE-2023-45160 Elevated Temp Directory Execution in 1E Client

   Published 2023-10-05

   High·CVSS 8.8 EPSS 0.88%

   In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary direc...

3. CVE-2023-45159 1E Client installer can perform arbitrary file deletion on protected files

   Published 2023-10-05

   High·CVSS 8.4 EPSS 0.23%

   1E Client installer can perform arbitrary file deletion on protected files. A non-privileged user could provide a symbolic link or Windows junction to point to a protected directory in the installer that the 1E Client would then clear on service startup. A hotfix is available fro...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.