CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
CVE-2025-35978: Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service...
7.1
CVSS
Description
Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.
Classification
CVE ID: CVE-2025-35978
CVSS Base Severity: HIGH
CVSS Base Score: 7.1
CVSS Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Affected Products
Vendor: Fujitsu Client Computing Limited
Product: UpdateNavi, UpdateNaviInstallService
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.01% (probability of being exploited)
EPSS Percentile: 1.69% (scored less or equal to compared to others)
EPSS Date: 2025-06-21 (when was this score calculated)
References
https://nvd.nist.gov/vuln/detail/CVE-2025-35978https://azby.fmworld.net/support/security/information/updatenavi202506/
https://jvn.jp/en/jp/JVN17860456/