CVE-2025-64151

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-64151", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "state": "PUBLISHED", "assignerShortName": "jpcert", "dateReserved": "2025-10-28T07:50:55.961Z", "datePublished": "2025-11-05T06:19:25.053Z", "dateUpdated": "2025-11-05T17:08:42.226Z"}, "containers": {"cna": {"affected": [{"vendor": "Roboticsware PTE. LTD.", "product": "FA-Panel6", "versions": [{"version": "Rev17 and earlier", "status": "affected"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "BA-Panel6", "versions": [{"version": "Rev17 and earlier", "status": "affected"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "PA-Panel6", "versions": [{"version": "Rev17 and earlier", "status": "affected"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "FA-Server6", "versions": [{"version": "Rev17 and earlier", "status": "affected"}]}], "descriptions": [{"lang": "en", "value": "Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege."}], "problemTypes": [{"descriptions": [{"description": "Unquoted search path or element", "lang": "en-US", "cweId": "CWE-428", "type": "CWE"}]}], "references": [{"url": "https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/"}, {"url": "https://jvn.jp/en/jp/JVN92563420/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_0": {"version": "3.0", "baseSeverity": "MEDIUM", "baseScore": 6.7, "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV4_0": {"version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.4, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-11-05T06:19:25.053Z"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T17:02:40.288523Z", "id": "CVE-2025-64151", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T17:08:42.226Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-64151", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-05T17:02:40.288523Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T17:08:35.980Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_0": {"version": "3.0", "baseScore": 6.7, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Roboticsware PTE. LTD.", "product": "FA-Panel6", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "BA-Panel6", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "PA-Panel6", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"vendor": "Roboticsware PTE. LTD.", "product": "FA-Server6", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}], "references": [{"url": "https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/"}, {"url": "https://jvn.jp/en/jp/JVN92563420/"}], "descriptions": [{"lang": "en", "value": "Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege."}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "CWE", "cweId": "CWE-428", "description": "Unquoted search path or element"}]}], "providerMetadata": {"orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "shortName": "jpcert", "dateUpdated": "2025-11-05T06:19:25.053Z"}}}, "cveMetadata": {"cveId": "CVE-2025-64151", "state": "PUBLISHED", "dateUpdated": "2025-11-05T17:08:42.226Z", "dateReserved": "2025-10-28T07:50:55.961Z", "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce", "datePublished": "2025-11-05T06:19:25.053Z", "assignerShortName": "jpcert"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "FA-Panel6", "vendor": "Roboticsware PTE. LTD.", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"product": "BA-Panel6", "vendor": "Roboticsware PTE. LTD.", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"product": "PA-Panel6", "vendor": "Roboticsware PTE. LTD.", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}, {"product": "FA-Server6", "vendor": "Roboticsware PTE. LTD.", "versions": [{"status": "affected", "version": "Rev17 and earlier"}]}], "source": "vultures@jpcert.or.jp"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege."}, {"lang": "es", "value": "M\u00faltiples productos de Roboticsware proporcionados por Roboticsware PTE. LTD. registran servicios de Windows con rutas de archivo sin comillas. Un usuario con permiso de escritura en el directorio ra\u00edz de la unidad del sistema puede ejecutar c\u00f3digo arbitrario con privilegios del Sistema."}], "id": "CVE-2025-64151", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 0.8, "impactScore": 5.9, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "vultures@jpcert.or.jp", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64151", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T17:02:40.288523Z", "version": "2.0.3"}}]}, "published": "2025-11-05T07:15:33.300", "references": [{"source": "vultures@jpcert.or.jp", "url": "https://jvn.jp/en/jp/JVN92563420/"}, {"source": "vultures@jpcert.or.jp", "url": "https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/"}], "sourceIdentifier": "vultures@jpcert.or.jp", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-428"}], "source": "vultures@jpcert.or.jp", "type": "Secondary"}]}

{}

{"created": "2025-11-06T10:07:24.313503+00:00", "updated": "2025-11-06T10:07:24.313527+00:00", "vendors": ["microsoft", "microsoft$PRODUCT$windows", "roboticsware", "roboticsware$PRODUCT$ba-panel6", "roboticsware$PRODUCT$fa-panel6", "roboticsware$PRODUCT$fa-server6", "roboticsware$PRODUCT$pa-panel6"]}