CVE-2025-66271

MEDIUM

ELECOM Clone for Windows < 2.36 - Unquoted Service Path Privilege Escalation

Title source: llm
STIX 2.1

Description

Clone for Windows provided by ELECOM CO.,LTD. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

References (2)

Core 2
Core References
Third Party Advisory
https://jvn.jp/en/jp/JVN33172708/

Scores

CVSS v3 6.7
EPSS 0.0013
EPSS Percentile 2.9%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-428
Status published
Products (1)
ELECOM CO.,LTD./Clone for Windows prior to Ver.2.36
Published Dec 09, 2025
Tracked Since Feb 18, 2026