NAS Navigator2 CVE-2025-61871

Exploitation requires that the attacker already have write permission on the root directory of the system drive (typically C:\) of a host where the BUFFALO NAS Navigator2 Windows version is installed and its service registered with an unquoted file path. On default Windows configurations, write access to the drive root is restricted to administrators, so this is primarily a local privilege-escalation/persistence vector or a risk in environments where non-default permissive ACLs grant standard users write access to C:\. Limiting factors: local access only (AV:L, not remotely reachable), high privilege prerequisite (PR:H), and the service must actually start (e.g., reboot or manual restart) for the planted binary to execute as SYSTEM.

This is a local privilege-escalation vulnerability (CWE-428, unquoted service path) rather than a remotely exploitable flaw, and the signals are consistent on that point. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N, VC:H/VI:H/VA:H, score 8.4) confirms local attack vector with high privileges already required - the attacker must already have write permission on the root of the system drive (C:\), which on default Windows configurations typically implies administrative rights. EPSS is low at 0.17% (6th percentile), the CVE is NOT in CISA KEV, and no public POC is referenced, so there is no evidence of active or imminent exploitation. The signals do not conflict: a low EPSS and absence of KEV align with a local-only, privilege-dependent weakness that is not attractive for mass exploitation. The 8.4 score is driven by the SYSTEM-level impact (full C/I/A compromise once triggered), not by ease of initial access. Net assessment: a legitimate hardening/patch item for environments running this Buffalo utility, but NOT an emergency remote-exploitation priority. Note the input's CVSS 4.0 PR:H slightly contrasts with scenarios where a non-admin user has been granted non-default write access to C:\ - in such misconfigured environments the effective privilege barrier is lower; verify local ACLs.

A local user (or a low-privilege process) that has write access to the root of the system drive places a malicious executable such as C:\Program.exe along the unquoted service path. When the NAS Navigator2 Windows service next starts (e.g., at boot), Windows executes the planted binary with SYSTEM privileges, giving the attacker full control of the host. No public exploit code is identified, but the technique is well-documented and trivially reproducible; the local attack vector and low complexity (AV:L/AC:L) make successful exploitation straightforward once write access to C:\ exists.