PT-2025-39638 · Seagate · Seagate Toolkit

Natthawut Saexu · CVE-2025-9267 · Published 2025-08-20 · Updated 2025-09-28

Positive Technologies (AI Summary)

CVSS v4.0

7.0

High

Base vector

AV:L/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Seagate Toolkit versions prior to 2.35.0.6

Description The software attempts to load DLLs from the current working directory without validating their origin or integrity. This can be exploited by placing a malicious DLL in the same directory as the installer executable, potentially leading to arbitrary code execution with the privileges of the user running the installer. The issue is due to insecure DLL loading practices, such as relying on relative paths when invoking system libraries.

Recommendations Update to version 2.35.0.6 or later.

Exploit

Fix

Untrusted Search Path

Uncontrolled Search Path Element

Weakness Enumeration

CWE-426

CWE-427

Related Identifiers

BDU:2025-12441

CVE-2025-9267

Affected Products

Seagate Toolkit

References · 11

• 🔥 https://github.com/Tiger3080/CVE-2025-9267 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-9267 · Security Note
• https://bdu.fstec.ru/vul/2025-12441 · Security Note
• https://twitter.com/CVEnew/status/1971561711623700877 · Twitter Post
• https://seagate.com/product-security/#security-advisories · Note
• https://seagate.com/support/software/toolkit · Note
• https://seagate.com/gb/en/product-security/#security-advisories · Note
• https://twitter.com/offseq/status/1972179905833021731 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1971747659326140736 · Twitter Post
• https://t.me/cveNotify/136558 · Telegram Post
• https://t.me/CVEtracker/33463 · Telegram Post