Published:2025/09/17  Last Updated:2025/09/17

JVN#84697061
Century HW RAID Manager registers a Windows service with an unquoted file path

Overview

RAID Manager provided by Century Corporation registers a Windows service with an unquoted file path.

Products Affected

  • RAID Manager
The products available on the vendor's site before September 1st, 2025 are affected.

Description

RAID Manager provided by Century Corporation contains the following vulnerability.

  • Unquoted search path or element (CWE-428)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
    • CVE-2025-59307

Impact

A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.

The vendor released the fixed version on September 1st, 2025.

Vendor Status

Vendor Link
Century Corporation Notice regarding vulnerability in Naked Intelligent Building Series RAID Manager (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-59307
JVN iPedia JVNDB-2025-000078