JVNDB-2025-000091

Multiple I-O DATA NAS management applications register Windows services with unquoted file paths

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths.
Multiple NAS management applications provided by I-O DATA DEVICE, INC. contain the following vulnerability.

• Unquoted search path or element (CWE-428) - CVE-2025-61865

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

I-O DATA DEVICE, INC.

• NarSuS app versions prior to Ver.2.33
• Clone for Windows versions prior to Ver.2.36

The affected products are available for multiple product series. For details, refer to the information provided by the developer.

A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

[Update the Software]
Update the software to the latest version according to the information provided by the developer.

I-O DATA DEVICE, INC.

• I-O DATA DEVICE, INC. : I-O DATA DEVICE, INC. website (in Japanese)
• JVN : Information from I-O DATA DEVICE, INC.

1. No Mapping(CWE-Other) [IPA Evaluation]

1. CVE-2025-61865

1. JVN : JVN#03295012

• [2025/10/22]
    Web page was published
  
• [2025/12/10]
    Title was modified
    Overview was modified
    Affected Products : Product was added
    Affected Products : Content was modified
    Vendor Information : Content was modified