PT-2025-25282 · Unknown · Updatenavi+1

Shu Yoshikoshi · Published 2025-06-12 · Updated 2025-06-12 · CVE-2025-35978

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions UpdateNavi versions 1.4 L10 through 1.4 L33 UpdateNaviInstallService Service versions 1.2.0091 through 1.2.0125

Description The issue exists due to improper restriction of communication channel to intended endpoints. If a local authenticated attacker sends malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.

Recommendations For UpdateNavi versions 1.4 L10 through 1.4 L33, consider restricting access to the communication channel to prevent malicious data from being sent. For UpdateNaviInstallService Service versions 1.2.0091 through 1.2.0125, consider implementing proper restrictions on the communication channel to intended endpoints to prevent arbitrary registry value modification or code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-923

Related Identifiers

CVE-2025-35978

Affected Products

Updatenavi

Updatenaviinstallservice Service

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-35978 · Security Note
• https://t.me/latest_high_impact_cve/2619 · Telegram Post
• https://azby.fmworld.net/support/security/information/updatenavi202506 · Note
• https://t.me/cvetracker/26070 · Telegram Post
• https://t.me/latest_high_impact_cve/2617 · Telegram Post
• https://jvn.jp/en/jp/JVN17860456 · Note
• https://twitter.com/CVEnew/status/1933054654750826617 · Twitter Post