Unquoted Service Path Vulnerability in Clone for Windows by ELECOM CO.,LTD.
CVE-2025-66271

8.4HIGH

Key Information:

Vendor

Elecom Co.,ltd.

Status
Clone For Windows
Vendor
CVE Published:
9 December 2025

What is CVE-2025-66271?

The Clone for Windows application from ELECOM CO.,LTD. contains a vulnerability due to the registration of a Windows service with an unquoted file path. This flaw allows a local user with write permissions on the root directory of the system drive to execute arbitrary code with SYSTEM privileges, which could lead to severe compromises within the target environment.

Affected Version(s)

Clone for Windows prior to Ver.2.36

References

https://www.elecom.co.jp/news/security/20251209-01/
https://jvn.jp/en/jp/JVN33172708/

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

CVSS V3.0

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-66271 : Unquoted Service Path Vulnerability in Clone for Windows by ELECOM CO.,LTD.