I-O DATA NAS CVE-2025-61865

Requires an attacker with an existing local foothold who has write permission on the root directory of the system drive (typically C:\), plus the affected I-O DATA NAS management application (e.g. NarSuS App or Clone for Windows) installed with a vulnerable unquoted service path. Exploitation is further gated by the need for the vulnerable service to (re)start - commonly at system reboot - to resolve the unquoted path and execute the planted binary. On default Windows configurations standard users cannot write to the system-drive root, so realistic exploitation depends on either prior administrative access or a misconfigured ACL that grants write access to lower-privileged users; this, together with the local-only attack vector, substantially limits widespread exploitation.

This is a local privilege-escalation issue (CWE-428, unquoted service path) in I-O DATA NAS management applications, and the signals are internally consistent and point to moderate, not urgent, priority. The vendor CVSS 4.0 vector (AV:L/AC:L/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.4) describes an attacker who already has local privileges and the ability to write to the root of the system drive, then escalates to SYSTEM - the high base score is driven by full C/I/A impact, not by ease of reach. EPSS reinforces low real-world risk at 0.20% (9th percentile), the CVE is NOT on CISA KEV, and no public exploit code was provided in the intelligence, so exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between EPSS and KEV here (neither indicates active exploitation). The one caveat defenders should verify: the reported PR:H assumes that writing to the system-drive root requires elevated rights, but on misconfigured hosts where standard users can write to C:\, the effective barrier is lower than PR:H implies - verify the ACLs on the system-drive root in your environment.

A local user (or low-privileged process/malware already on the host) who can write to the root of the system drive plants a malicious executable such as C:\Program.exe. Because the I-O DATA NAS management service is registered with an unquoted path containing spaces, Windows runs the planted binary instead of the intended service executable the next time the service starts or the machine reboots, executing attacker code as SYSTEM. No public proof-of-concept was supplied in the provided intelligence.