PT-2025-28461 · Unknown · Advanced Installer

Published 2025-07-08 · Updated 2025-07-08 · CVE-2025-47422

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Advanced Installer versions prior to 22.6

Description: The issue is related to an uncontrolled search path element local privilege escalation. When running as SYSTEM in certain configurations, Advanced Installer looks in standard-user writable locations for non-existent binaries and executes them as SYSTEM. A low-privileged attacker can place a malicious binary in a targeted folder, achieving arbitrary SYSTEM code execution when the installer is executed.

Recommendations: For versions prior to 22.6, update to version 22.6 or later to resolve the issue. As a temporary workaround, consider restricting access to standard-user writable locations to minimize the risk of exploitation.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2025-47422

Affected Products

Advanced Installer

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-47422 · Security Note
• https://advancedinstaller.com/advanced-installer-security-fixes-retrospective.html#update-deprecated-apis-used-to-resolve-paths · Note
• https://advancedinstaller.com/advanced-installer-security-fixes-retrospective.html · Note
• https://advancedinstaller.com/release-22.6.html · Note
• https://t.me/cvenotify/128080 · Telegram Post
• https://twitter.com/CVEnew/status/1942594421309964609 · Twitter Post