HIGH
NAS Navigator2 Windows version by BUFFALO INC
Published Oct 10, 2025
8.4
HIGHCVSS 4.0
EPSS 0.17%
Description
NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.
Affected products
-
- Version prior to Ver.3.12.0StatusaffectedConstraints-
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Buffalo Inc. | NAS Navigator2 (Windows version only) | n/a |
|
No data.
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (1)
References (3)
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner jpcert
Published Oct 10, 2025
Updated Oct 10, 2025
Reserved Oct 2, 2025
Link CVE-2025-61871
CISA Vulnrichment
Updated Oct 10, 2025
ENISA EUVD
EUVD-2025-33659 Assigner jpcert
Published Oct 10, 2025
Updated Oct 10, 2025
Exploited since n/a
Link EUVD-2025-33659