EUVD-2026-53043
GHSA-8f6m-wc9x-fw73
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local-only vector, high complexity for search-path alignment, low-privilege auth required, user interaction to trigger DLL load; SYSTEM execution yields full CIA impact.
Primary rating from Vendor (jpcert).
CVSS VectorVendor: jpcert
Lifecycle Timeline
2DescriptionCVE.org
NetKids iMark, provided by Integrated Systems Technologies, Inc., contains an Uncontrolled Search Path Element vulnerability (CWE-427). An authenticated attacker may exploit this vulnerability to execute arbitrary code with SYSTEM privileges.
AnalysisAI
Privilege escalation to SYSTEM in NetKids iMark, a parental control product by Integrated Systems Technologies, Inc. (Japan), allows an authenticated local attacker to execute arbitrary code at the highest privilege level by exploiting an uncontrolled DLL search path. The JPCERT advisory (JVN#28045338) documents two related weaknesses: DLL hijacking via improper search path handling (CWE-427) and a secondary unquoted service path issue, both enabling privilege escalation on affected Windows hosts. No public exploit code or CISA KEV listing has been identified at time of analysis.
Technical ContextAI
CWE-427 (Uncontrolled Search Path Element) describes a class of vulnerabilities where an application searches for a DLL or executable in directories that a low-privileged user can write to before the legitimate file location is checked. On Windows, this manifests as DLL hijacking: the application or one of its services loads a named DLL at startup without specifying an absolute path, causing Windows to resolve the library through the standard search order (current directory, PATH entries, etc.). The CPE string cpe:2.3:a:integrated_systems_technologies,_inc.:netkids_imark:*:*:*:*:*:*:*:* covers all versions with no upper-bound restriction, indicating no version has been confirmed safe. The vendor's advisory PDFs additionally describe an unquoted service path issue - a Windows service whose executable path is not enclosed in quotes, allowing an attacker to place a crafted binary at a path prefix that Windows resolves first. Both weaknesses share the same root cause: unsanitized or improperly quoted filesystem references resolved at elevated privilege.
RemediationAI
The primary fix is to apply the patched version released by Integrated Systems Technologies, Inc. as documented in the vendor advisory accessible via the JVN entry at https://jvn.jp/en/jp/JVN28045338/. The exact remediated version number is not independently confirmed in the available intelligence; consult the vendor PDFs directly for the precise release. As a compensating control where immediate patching is not feasible, restrict write permissions on the NetKids iMark installation directory and all directories that appear in the system PATH to prevent low-privileged users from placing rogue DLLs. For the unquoted service path issue, enclose the NetKids iMark service executable path in double quotes within the Windows service registry entry (HKLM\SYSTEM\CurrentControlSet\Services\) - this prevents Windows from resolving space-delimited path prefixes as executable candidates. Note that registry edits require administrator access and should be tested for service continuity before deployment. Neither workaround eliminates the root CWE-427 defect; they reduce exploitability until the vendor patch is applied.
More in Netkids Imark
View allSame weakness CWE-427 – Uncontrolled Search Path Element
View allShare
External POC / Exploit Code
Leaving vuln.today