CVE-2025-34352: Remote Assist 0 to before 0.317.0

Affected technology

Remote Assist · 0 to before 0.317.0
JumpCloud Inc.

Description’s affected range: versions prior to 0.317.0 include an uninstaller that is invoked by the JumpCloud Windows Agent as NT AUTHORITY\SYSTEM during agent uninstall or update operations

Component: Remote Assist Uninstaller

Attack conditions (Vendor/CNA, CVSS 4.0): Local · Low privileges required · No user interaction required

What an attacker can do

Low-privileged attacker can pre-create the directory with weak permissions and leverage mount-point or symbolic-link redirection to (a) coerce arbitrary file writes to protected locations, leading to denial of service (e.g., by overwriting sensitive system files), or (b) win a race to redirect DeleteFileW() to attacker-chosen targets, enabling arbitrary file or folder deletion and local privilege escalation to SYSTEM. Vendor/CNA’s CVSS 4.0 assessment (base score 8.5/10) rates confidentiality, integrity and availability impact as high.