6.7Medium

CVE-2025-61871

BUFFALO INC. NAS Navigator2 (Windows version only) Published: 2025-10-10 07:52 (1 year ago)

Description

NAS Navigator2 Windows version by BUFFALO INC. registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Weakness (CWE): CWE-428

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
BUFFALO INC.	NAS Navigator2 (Windows version only)	prior to Ver.3.12.0

References and patches

CVSS score

6.7Medium

Source: jpcert · CVSS 3.0

Attack vector: Local
Attack complexity: Low
Privileges required: High
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

All scores (4)

cna	CVSS 3.0	6.7Medium
cna	CVSS 4.0	8.4High
vultures@jpcert.or.jp	CVSS 4.0	8.4High
vultures@jpcert.or.jp	CVSS 3.0	6.7Medium

EPSS (chance of exploitation in 30 days)

0.17%

higher than 6% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: total

Timeline

ID reserved2025-10-02
Published2025-10-10 07:52
Reached IP-DB2026-10-25 00:01
Last updated2026-10-08 16:10

Assigned by (CNA): jpcert
NVD status: Deferred

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time