JVN#75211379
Western Digital Kitfox registers a Windows service with an unquoted file path

Overview

Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path.

Products Affected

• Western Digital Kitfox for Windows versions prior to 1.1.1.1

Description

Western Digital Kitfox for Windows provided by Western Digital Corporation contains the following vulnerability.

• Unquoted search path or element (CWE-428)
  • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
  • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
  • CVE-2025-57699

Impact

A user with the write permission on the root directory of the system drive may execute arbitrary code with the SYSTEM privilege.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.