CVE-2025-60320
BaseFortify
Publication date: 2025-10-29
Last updated on: 2025-10-30
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| memoq | memoq | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an unquoted service path issue in the memoQ Auto Update Service (memoQauhlp101) in memoQ version 10.1.13.ef1b2b52aae and earlier. Because the service path contains spaces but is not enclosed in quotes, a local user can place a malicious executable named C:\Program.exe, which the system might execute with elevated privileges, allowing the user to escalate their privileges to SYSTEM.
How can this vulnerability impact me? :
The vulnerability allows a local user to escalate their privileges to SYSTEM level by exploiting the unquoted service path. This means an attacker with local access could gain full control over the affected system, potentially leading to unauthorized access, data manipulation, or further compromise of the system.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking the service path of the memoQ Auto Update Service (memoQauhlp101) to see if it is unquoted and contains spaces. On a Windows system, use the command: sc qc memoQauhlp101. Review the BINARY_PATH_NAME output to see if the path is unquoted and contains spaces, which indicates the vulnerability.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately correct the service path by adding quotes around the executable path in the service configuration to prevent privilege escalation. Alternatively, ensure no malicious executable exists at C:\Program.exe and restrict write permissions to this location to prevent exploitation.