Unquoted File Path Vulnerability in NarSuS App by I-O Data
CVE-2025-61865
8.4HIGH
What is CVE-2025-61865?
The NarSuS App from I-O Data has a critical flaw related to the registration of a Windows service with an unquoted file path. This vulnerability allows users with write permissions on the system drive's root directory to potentially execute arbitrary code with SYSTEM privileges. Proper path quoting is essential to prevent malicious exploitation of this flaw, highlighting the importance of secure software practices.
Affected Version(s)
Clone for Windows prior to Ver2.36
NarSuS App prior to Ver.2.33
References
CVSS V4
Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
CVSS V3.0
Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved