CVE-2025-61865

Severity: high (CVSS 8.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-10-23 · updated 2026-10-18
Weakness: CWE-428

Description

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Affected products

I-O DATA DEVICE, INC. Clone for Windows: before Ver2.36
I-O DATA DEVICE, INC. NarSuS App: before Ver.2.33

References

https://jvn.jp/en/jp/JVN03295012/
https://www.iodata.jp/support/information/2025/10_NarSuS_App/
https://www.iodata.jp/support/information/2025/12_CloneforWindows/

Get alerted when CVE-2025-61865 or the next vulnerability affects your stack