CVE-2025-61865

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

• CWE-428

• https://jvn.jp/en/jp/JVN03295012/
• https://www.iodata.jp/support/information/2025/10_NarSuS_App/
• https://www.iodata.jp/support/information/2025/12_CloneforWindows/

Published

Oct 23, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-6186An issue has been discovered in GitLab CE/EE affecting all v…5.4
• CVE-2025-61860An out-of-bounds read vulnerability exists in VS6MemInIF!set…8.4
• CVE-2025-61861An out-of-bounds read vulnerability exists in VS6ComFile!loa…8.4
• CVE-2025-61862An out-of-bounds read vulnerability exists in VS6ComFile!get…8.4
• CVE-2025-61863An out-of-bounds read vulnerability exists in VS6ComFile!CSa…8.4
• CVE-2025-61864A use after free vulnerability exists in VS6ComFile!load_lin…8.4
• CVE-2025-6187The bSecure plugin for WordPress is vulnerable to Privilege …9.8
• CVE-2025-61871NAS Navigator2 Windows version by BUFFALO INC. registers a W…8.4
• CVE-2025-61872Mahara before 25.04.2 and 24.04.11 are vulnerable to display…6.1
• CVE-2025-61873Best Practical Request Tracker (RT) before 4.4.9, 5.0.9, and…2.6
• CVE-2025-61876Insecure Direct Object Reference (IDOR) in /tenants/{id} API…5
• CVE-2025-61879In Infoblox NIOS through 9.0.7, a High-Privileged User Can T…7.7