CVE-2025-61865CWE-428

CVE-2025-61865

Medium · published October 23, 2025

CVSS v3.0
6.7
EPSS
0%
Percentile
9.1
In the wild
Unconfirmed
What it is

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

The record
Technical detail
CVSS v3.0
6.7 · MEDIUM
Vector
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00198 · 9.1th percentile
Weakness
CWE-428 · Unquoted Search Path or Element
Published
2025-10-23T09:15Z
References (3)
https://jvn.jp/en/jp/JVN03295012/ · [email protected]https://www.iodata.jp/support/information/2025/10_NarSuS_App/ · [email protected]https://www.iodata.jp/support/information/2025/12_CloneforWindows/ · [email protected]
EPSS history
Timeline
  • 23 OCT 04:14Z
    Multiple NAS management applications provided by I-O DATA DEVICE, INC
    cvelistv5