Hasleo Backup Suite CVE-2025-12247

Q: What is the CVSS score of CVE-2025-12247?

CVE-2025-12247 has a CVSS 4.0 base score of 6.4 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

MEDIUM

Untrusted Search Path (CWE-426)

2025-10-27 cna@vuldb.com

Information Disclosure

6.4

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.8 HIGH

Local vector, write-access prerequisite drives AC:H and PR:L; service runs as SYSTEM constituting scope change to S:C with full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:14 vuln.today

DescriptionCVE.org

A weakness has been identified in Hasleo Backup Suite up to 5.2. Impacted is an unknown function of the component HasleoImageMountService/HasleoBackupSuiteService. This manipulation causes unquoted search path. The attack is restricted to local execution. The attack's complexity is rated as high. The exploitability is considered difficult. The exploit has been made available to the public and could be exploited. Upgrading the affected component is advised.

AnalysisAI

Unquoted service path privilege escalation in Hasleo Backup Suite up to version 5.2 exposes local users to SYSTEM-level code execution via the HasleoImageMountService and HasleoBackupSuiteService Windows services. A low-privileged local attacker who can write to a directory resolved before the legitimate service binary can plant a malicious executable that runs as SYSTEM on the next service start or system reboot. A public proof-of-concept exists per the CVSS 4.0 E:P metric and referenced GitHub repositories, though EPSS at 0.01% (3rd percentile) indicates no observed widespread exploitation.

Technical ContextAI

CWE-426 (Untrusted Search Path / Unquoted Service Path) is a Windows-specific misconfiguration class. When a Windows service is registered in the registry with an executable path containing spaces but lacking enclosing quotation marks - for example C:\Program Files\Hasleo\service.exe rather than "C:\Program Files\Hasleo\service.exe" - the Windows Service Control Manager resolves ambiguity by sequentially testing candidate executables derived by splitting on each space character. This allows an attacker with write access to an earlier-resolved directory (e.g., C:\Program.exe or C:\Program Files\Hasleo.exe) to interpose a malicious binary. Both HasleoImageMountService and HasleoBackupSuiteService within Hasleo Backup Suite up to 5.2 are identified as affected components. The CVSS 4.0 vector AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H confirms local vector with high attack complexity reflecting the write-access prerequisite.

Affected ProductsAI

Hasleo Backup Suite versions up to and including 5.2 are confirmed affected, specifically the HasleoImageMountService and HasleoBackupSuiteService Windows service components. No CPE string was provided in the source data; affected versions are based on NVD and VulDB reporting (vuldb.com/?id.329918, ctiid.329918). The vendor's distribution page is at https://www.easyuefi.com/backup-software/downloads/Hasleo_Backup_Suite_Free.exe, though no explicit patched release version is documented in the available intelligence.

RemediationAI

The vendor advises upgrading Hasleo Backup Suite beyond version 5.2; however, no specific patched version number is confirmed in the available data - the upgrade advisory is sourced from VulDB and NVD rather than a vendor security bulletin. Until a verified patched release is confirmed, the most effective compensating control is to manually correct the unquoted service path in the Windows registry: open regedit, navigate to HKLM\SYSTEM\CurrentControlSet\Services\HasleoImageMountService and HasleoBackupSuiteService, and ensure the ImagePath values are fully quoted. This eliminates the path-resolution ambiguity without removing the software. Additionally, administrators should audit and restrict write permissions on directories that form components of the service paths (e.g., C:\Program Files and any Hasleo subdirectories) to prevent low-privileged users from planting executables. No vendor advisory URL with a specific fixed version was identified at time of analysis; monitor https://www.easyuefi.com for release announcements.