Published:2025/11/25  Last Updated:2025/11/25

JVN#76298784
Multiple vulnerabilities in Security Point (Windows) of MaLion

Overview

Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities.

Products Affected

CVE-2025-59485

  • Security Point (Windows) of MaLion prior to Ver.5.3.4
CVE-2025-62691, CVE-2025-64693
  • Security Point (Windows) of MaLion prior to Ver.7.1.1.9
  • Security Point (Windows) of MaLionCloud prior to Ver.7.2.0.1

Description

Security Point (Windows) of MaLion provided by Intercom, Inc. contains multiple vulnerabilities listed below.

  • Incorrect default permissions (CWE-276)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 4.8
    • CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N Base Score 3.3
    • CVE-2025-59485
  • Stack-based buffer overflow in processing HTTP headers (CWE-121)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
    • CVE-2025-62691
  • Heap-based buffer overflow in processing Content-Length (CWE-122)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 9.3
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Base Score 9.8
    • CVE-2025-64693

Impact

  • An arbitrary file could be placed in the specific folder by a user who can log in to the system where the product's Windows client is installed. If the file is a specially crafted DLL file, arbitrary code could be executed with SYSTEM privilege (CVE-2025-59485)
  • Receiving a specially crafted request from a remote unauthenticated attacker could lead to arbitrary code execution with SYSTEM privilege (CVE-2025-62691, CVE-2025-64693)

Solution

Update the product
Update the product to the latest version according to the information provided by the developer.
The developer has released the following updates that contain fixes for these vulnerabilities.

CVE-2025-59485

  • Security Point (Windows) of MaLion Ver.5.3.4 or later
CVE-2025-62691, CVE-2025-64693
  • Security Point (Windows) of MaLion Ver.7.1.1.9 or later
  • Security Point (Windows) of MaLionCloud Ver.7.2.0.1 or later

Vendor Status

Vendor Link
Intercom, Inc. About vulnerabilities in MaLion Security Point (Windows) (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

CVE-2025-59485
Ruslan Sayfiev of GMO Cybersecurity by Ierae, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

CVE-2025-62691, CVE-2025-64693
Denis Faiustov, and Ruslan Sayfiev of GMO Cybersecurity by Ierae, Inc. reported these vulnerabilities to JPCERT/CC.
JPCERT/CC coordinated with the developer.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-59485
CVE-2025-62691
CVE-2025-64693
JVN iPedia JVNDB-2025-000110