Published:2025/11/04  Last Updated:2025/11/04

JVN#92563420
Multiple Roboticsware products register Windows services with unquoted file paths

Overview

Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths.

Products Affected

  • FA-Panel6 Rev17 and earlier
  • BA-Panel6 Rev17 and earlier
  • PA-Panel6 Rev17 and earlier
  • FA-Server6 Rev17 and earlier

Description

Multiple Roboticsware products provided by Roboticsware PTE. LTD. contain the following vulnerability.

  • Unquoted search path or element (CWE-428)
    • CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 8.4
    • CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Base Score 6.7
    • CVE-2025-64151

Impact

A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Solution

Apply the patch
Apply the patch provided by the developer.

Vendor Status

Vendor Link
Roboticsware PTE. LTD. Vulnerability in Service Registration Path (Text in Japanese)

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-64151
JVN iPedia JVNDB-2025-000100