CVE-2025-54081

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-54081", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2025-07-16T13:22:18.207Z", "datePublished": "2025-09-23T18:18:39.474Z", "dateUpdated": "2025-09-23T19:17:53.733Z"}, "containers": {"cna": {"title": "SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-428", "lang": "en", "description": "CWE-428: Unquoted Search Path or Element", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h"}, {"name": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824", "tags": ["x_refsource_MISC"], "url": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824"}, {"name": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222", "tags": ["x_refsource_MISC"], "url": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222"}], "affected": [{"vendor": "LizardByte", "product": "Sunshine", "versions": [{"version": "< 2025.923.33222", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-23T18:18:39.474Z"}, "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222."}], "source": {"advisory": "GHSA-6p7j-5v8v-w45h", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T19:15:27.573785Z", "id": "CVE-2025-54081", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:17:53.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-54081", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-23T19:15:27.573785Z"}}}], "references": [{"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:15:30.276Z"}}], "cna": {"title": "SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution", "source": {"advisory": "GHSA-6p7j-5v8v-w45h", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "LizardByte", "product": "Sunshine", "versions": [{"status": "affected", "version": "< 2025.923.33222"}]}], "references": [{"url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "name": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824", "name": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222", "name": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-428", "description": "CWE-428: Unquoted Search Path or Element"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2025-09-23T18:18:39.474Z"}}}, "cveMetadata": {"cveId": "CVE-2025-54081", "state": "PUBLISHED", "dateUpdated": "2025-09-23T19:17:53.733Z", "dateReserved": "2025-07-16T13:22:18.207Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2025-09-23T18:18:39.474Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Sunshine", "vendor": "LizardByte", "versions": [{"status": "affected", "version": "< 2025.923.33222"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:lizardbyte:sunshine:*:*:*:*:*:*:*:*", "matchCriteriaId": "EBAEB372-589D-4C6A-A10B-1D654BB16BB9", "versionEndExcluding": "2025.923.33222", "versionStartIncluding": "0.10.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Sunshine is a self-hosted game stream host for Moonlight. Prior to version 2025.923.33222, the Windows service SunshineService is installed with an unquoted executable path. If Sunshine is installed in a directory whose name includes a space, the Service Control Manager (SCM) interprets the path incrementally and may execute a malicious binary placed earlier in the search string. This issue has been patched in version 2025.923.33222."}, {"lang": "es", "value": "Sunshine es un anfitri\u00f3n de transmisi\u00f3n de juegos autoalojado para Moonlight. Antes de la versi\u00f3n 2025.923.33222, el servicio de Windows SunshineService se instala con una ruta de ejecutable sin comillas. Si Sunshine se instala en un directorio cuyo nombre incluye un espacio, el Administrador de Control de Servicios (SCM) interpreta la ruta de forma incremental y puede ejecutar un binario malicioso colocado antes en la cadena de b\u00fasqueda. Este problema ha sido parcheado en la versi\u00f3n 2025.923.33222."}], "id": "CVE-2025-54081", "lastModified": "2026-10-11T20:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54081", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-23T19:15:27.573785Z", "version": "2.0.3"}}]}, "published": "2025-09-23T19:15:39.963", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/LizardByte/Sunshine/commit/f22b00d6981f756d3531fba0028723d4a5065824"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/LizardByte/Sunshine/releases/tag/v2025.923.33222"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/LizardByte/Sunshine/security/advisories/GHSA-6p7j-5v8v-w45h"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-428"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"created": "2025-09-25T08:22:16.771587+00:00", "updated": "2025-09-25T08:22:16.771641+00:00", "vendors": ["lizardbyte", "lizardbyte$PRODUCT$sunshine", "microsoft", "microsoft$PRODUCT$windows"]}