PT-2025-41386 · Lavasoft · Lavasoft Web Companion

Marco Montella + 1 · Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-45095

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Lavasoft Web Companion versions 8.9.0.1091 through 12.1.3.1037

Description Lavasoft Web Companion (also known as Ad-Aware WebCompanion) installs the DCIService.exe service with an unquoted service path. An attacker with write access to the file system could potentially execute arbitrary code with elevated privileges by placing a malicious executable in the unquoted path.

Recommendations Update Lavasoft Web Companion to a version later than 12.1.3.1037.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2025-45095

Affected Products

Lavasoft Web Companion

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2025-45095 · Security Note
• https://twitter.com/CVEnew/status/1976306135385997490 · Twitter Post
• https://gist.github.com/T4rantell/cd73592950c4ac700b40cc8e8e36494d · Note