PT-2025-30547 · Aes+1 · Aes+1

Kazuma Matsumoto · Published 2025-07-23 · Updated 2025-07-24 · CVE-2025-8070

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions ABP versions prior to 2.0.7.6130 AES versions prior to 1.0.6.6133

Description The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces.

Recommendations Ensure the ImagePath registry value for ABP services is properly quoted. Ensure the ImagePath registry value for AES services is properly quoted.

Fix

LPE

Weakness Enumeration

CWE-428

Related Identifiers

CVE-2025-8070

Affected Products

Abp

Aes

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-8070 · Security Note
• https://asustor.com/security/security_advisory_detail?id=47 · Vendor Advisory
• https://twitter.com/CVEnew/status/1947926010466275511 · Twitter Post
• https://twitter.com/marcin_brz81183/status/1947932999716094218 · Twitter Post
• https://t.me/pentestingnews/65059 · Telegram Post
• https://t.me/CVEtracker/28475 · Telegram Post
• https://twitter.com/fridaysecurity/status/1948174933579993094 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1948075574548668806 · Twitter Post