Published:2026/03/25  Last Updated:2026/03/25

JVN#90835713
SANYO DENKI SANUPS SOFTWARE registers Windows services with unquoted file paths

Overview

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. registers Windows services with unquoted file paths.

Products Affected

  • SANUPS SOFTWARE STANDALONE Ver.1.0.1 to Ver.1.1.4
  • SANUPS SOFTWARE Ver.2.0.0 to Ver.2.0.2
  • SANUPS SOFTWARE Ver.1.0.0 to Ver.1.1.4

Description

SANUPS SOFTWARE provided by SANYO DENKI CO., LTD. contains the following vulnerability.

  • Unquoted search path or element (CWE-428)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
    • CVE-2026-33253

Impact

A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Solution

Update the Software
Update the software to the latest version according to the information provided by the developer.
The developer has released the following versions to fix the vulnerability.

  • For SANUPS SOFTWARE STANDALONE Ver.1.0.1 and Ver.1.1.0 to Ver.1.1.4
    • SANUPS SOFTWARE STANDALONE Ver.1.1.5
  • For SANUPS SOFTWARE Ver.2.0.0 to Ver.2.0.2
    • SANUPS SOFTWARE Ver.2.0.3
For SANUPS SOFTWARE Ver.1.0.0 to Ver.1.1.4, replace it with Ver.3.0.1. For more information, refer to the information provided by the developer.

Vendor Status

Vendor Link
SANYO DENKI CO., LTD. Notice of Version Upgrade Due to a Security Vulnerability in SANUPS SOFTWARE STANDALONE and SANUPS SOFTWARE (PDF)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2026-33253
JVN iPedia JVNDB-2026-000041