What is the CVSS score of CVE-2025-46355?

CVE-2025-46355 has a CVSS 3.0 base score of 7.3 (High). CVSS vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-46355?

CVE-2025-46355 affects PC Time Tracer versions prior to 5.2 and allows local authenticated users to execute arbitrary code with SYSTEM-level privileges on Windows systems.

How to fix or mitigate CVE-2025-46355?

Within 24 hours: Inventory all systems running PC Time Tracer and identify versions below 5.2; restrict local access to affected systems where feasible. Within 7 days: Contact vendor for release timeline of version 5.2 patch; evaluate business criticality of each affected system and prioritize accordingly. Within 30 days: Apply vendor patch immediately upon availability to all affected systems, or implement compensating controls if patch timeline extends beyond this window.

Windows CVE-2025-46355

EUVD-2025-16715 HIGH

Incorrect Default Permissions (CWE-276)

2025-06-03 vultures@jpcert.or.jp

RCE Privilege Escalation Windows

7.3

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 14, 2026 - 17:04 euvd

EUVD-2025-16715

Analysis Generated

Mar 14, 2026 - 17:04 vuln.today

CVE Published

Jun 03, 2025 - 08:15 nvd

HIGH 7.3

DescriptionCVE.org

Incorrect default permissions issue in PC Time Tracer prior to 5.2. If exploited, arbitrary code may be executed with SYSTEM privilege on Windows system where the product is running by a local authenticated attacker.

AnalysisAI

PC Time Tracer versions prior to 5.2 contain an incorrect default permissions vulnerability (CWE-276) that allows local authenticated attackers to execute arbitrary code with SYSTEM privileges on Windows systems. The vulnerability requires local access and user interaction but provides complete system compromise capability. No KEV/CISA known exploited vulnerability status or public POC availability is confirmed from the provided data, though the CVSS 7.3 score and EPSS analysis should be monitored for exploitation likelihood.

Technical ContextAI

This vulnerability stems from improper file or registry permission assignments in PC Time Tracer, classified under CWE-276 (Incorrect Default Permissions). Windows-based applications often run with elevated privileges or interact with system resources; if default DACL (Discretionary Access Control List) configurations permit low-privileged users to modify executable files, DLLs, configuration files, or scheduled tasks owned by the application, privilege escalation becomes possible. The root cause likely involves file/directory permissions on application directories (typically C:\Program Files\PC Time Tracer or similar) that inadvertently grant write access to authenticated local users, enabling DLL injection, executable replacement, or configuration manipulation. CPE identification would be: cpe:2.3:a:*:pc_time_tracer:*:*:*:*:*:*:*:* (versions <5.2).

RemediationAI

Immediate Patch: Upgrade PC Time Tracer to version 5.2 or later. Obtain the patch from the official vendor download portal or auto-update mechanism. 2. Pre-Patch Mitigation: Restrict file and directory permissions on the PC Time Tracer installation directory (typically C:\Program Files\PC Time Tracer) to remove write access for non-administrator users; use icacls or Group Policy to enforce ACLs removing authenticated user write permissions. 3. Access Control: Limit local login privileges to trusted users; disable remote access if not required. Monitor and restrict scheduled task execution triggered by the application. 4. Detection: Audit file modification events in the application directory and monitor for unexpected process elevation or DLL loading from the application folder.