CVE-2025-61871
BaseFortify
Publication date: 2025-10-10
Last updated on: 2025-10-14
Assigner: JPCERT/CC
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| buffalo | nas_navigator2 | 3.12.0 |
| buffalo | nas_navigator2 | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-428 | The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in BUFFALO INC.'s NAS Navigator2 Windows version prior to 3.12.0, where the software registers a Windows service with an unquoted file path. Because of this, a user who has write permission on the root directory of the system drive can exploit this to execute arbitrary code with SYSTEM privileges. This is known as an unquoted search path vulnerability (CWE-428). [1, 2]
How can this vulnerability impact me? :
If you have this vulnerable version of NAS Navigator2 installed on a Windows system, an attacker with write access to the root of your system drive could execute arbitrary code with SYSTEM-level privileges. This means the attacker could potentially take full control of your system, leading to severe security risks including data compromise, system manipulation, or disruption. [1, 2]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by checking if the NAS Navigator2 Windows service is registered with an unquoted file path. On a Windows system, you can use the command: sc qc <service_name> to query the service configuration and look for unquoted paths in the BINARY_PATH_NAME. Replace <service_name> with the actual service name related to NAS Navigator2. If the path to the executable is unquoted and contains spaces, the system is vulnerable. [1, 2]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update NAS Navigator2 to the latest version, specifically version 3.12.0 or later, as provided by BUFFALO INC. This update addresses the unquoted service path vulnerability. Additionally, restrict write permissions to the root directory of the system drive to prevent unauthorized users from exploiting this vulnerability. [1, 2]