N A EUVD-2025-210499

We are tasked with synthesizing a comprehensive analysis for CVE-2025-50329 from multiple intelligence sources. The output must be a single JSON object with specific fields. We must use all data provided: description, CVSS, EPSS, tags, SSVC, CPE, references, etc. And follow precision rules.

Let's review the input data:

• CVE ID: CVE-2025-50329
• Description: "An issue in ConeXware, Inc Power Archiver v.22.00.11 and before allows a remote attacker to escalate privileges and execute arbitrary code via the powerarc.exe."
• CVSS: 9.8, vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• CWE: CWE-693 (Protection Mechanism Failure)
• EPSS: 0.36% (percentile 28%) - low
• Tags: RCE, N A (maybe "N/A"?)
• SSVC: Exploitation: none, Automatable: yes, Technical Impact: total
• CPE: cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:* - this is weird, maybe placeholder.
• Affected versions EUVD: ["n/a n/a"]
• References:
• https://www.powerarchiver.com/ (vendor site)
• https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md (a GitHub reference, likely a PoC/advisory)
• https://github.com/OV-0-VO/Public-references/commit/20437207859288ad1502fed2caebc38be27a3450 (commit diff)
• Source code evidence from GitHub: shows a diff in CVE-2025-50329.md. The diff shows a fix: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - the original line had a trailing space? Actually the diff shows a line change on line 15+4: the original had a space at end? It's unclear. But the important part is the description in the diff context: "When extracting files from an archive that bears Mark-of-the-Web, PowerArchiver" - suggests the vulnerability is related to Mark-of-the-Web handling during extraction, leading to code execution? The commit just removed a trailing space, but the file content itself might have more info. We can view the GitHub file to see the full description. But we only have this diff snippet. We'll infer from the CVE description and tags.

Additional info: The CVE description mentions "escalate privileges and execute arbitrary code via the powerarc.exe". No explicit mention of authentication, but CVSS says PR:N so unauthenticated. No mention of KEV, so no active exploitation. No POC tag? Tags include "RCE, N A" - maybe "N A" means "not applicable"? Possibly "no auth"? Not sure. The GitHub repo "Public-references" could contain a proof-of-concept or at least a reference. Given that there's a GitHub reference, likely a public PoC exists. The SSVC says exploitation=none, but automatable=yes, which could mean it's easy to automate. EPSS is 0.36% (low) suggests low likelihood of exploitation in the wild right now. However, the CVSS is critical 9.8, so there is a tension: high CVSS, low EPSS. No KEV listing.

We need to construct the JSON. Let's break down each field:

product_name: "Power Archiver" (from ConeXware, Inc Power Archiver version 22.00.11 and before). So simply "Power Archiver".

summary: Must be original synthesis, not copying description. Start with impact verb and product. So: "Remote code execution in Power Archiver 22.00.11 and earlier allows unauthenticated attackers to escalate privileges and execute arbitrary code via the powerarc.exe executable." Mention EPSS low, no KEV, PoC possibly available? The references suggest a GitHub advisory with details, so likely PoC. Should mention "publicly available exploit code exists" if we infer that. But precision rule: "If POC=YES but no KEV: 'publicly available exploit code exists'". We don't have explicit POC=YES, but the GitHub reference likely is a PoC repo. The commit message doesn't reveal exploit code, just a diff of the markdown file. But the file itself might contain PoC. Since it's from a repository named "Public-references" and the CVE ID is in the title, it's reasonable that the public reference includes exploit details. However, we must be careful: we only have the diff snippet, which just shows a change to the markdown file. The full file might describe the vulnerability and maybe a PoC. But we can't be certain there's a functional exploit. The SSVC says "Exploitation: none", meaning no evidence of exploitation. So I'll assume no active exploitation, but there might be a public technical write-up with possibly PoC details. The precision rule for "publicly available exploit code exists" would be if POC=YES. The input doesn't explicitly say POC=YES. I'll instead say "A technical write-up is publicly available; no exploit code has been confirmed" or something. But the instruction says: "If POC=YES but no KEV: 'publicly available exploit code exists'". Since POC flag isn't given, I'll use "no public exploit identified at time of analysis" as per rule: "If neither: 'no public exploit identified at time of analysis'". That would be conservative. However, the GitHub reference might be a PoC; the file name "CVE-2025-50329.md" could contain steps to reproduce. But the diff only shows a line about Mark-of-the-Web extraction. It's not a functional exploit. So I'll stick with "no public exploit identified at time of analysis". But we can note the existence of a technical write-up. The summary can mention "A proof-of-concept may be available" but the precision rule forbids speculation. I'll avoid claiming exploit code exists. So summary: "Remote code execution in Power Archiver 22.00.11 and earlier allows remote attackers to escalate privileges and execute arbitrary code. The flaw is reachable over the network without authentication. EPSS predicts low exploitation probability, but the vulnerability is easily automatable and has total technical impact." I'll incorporate that.

technical_context: Underlying technology: Power Archiver is a file compression utility. The vulnerability likely stems from improper handling of Mark-of-the-Web when extracting archive files, leading to a protection mechanism failure (CWE-693) that allows arbitrary code execution. The CPE string is cpe:2.3:a:n/a:n/a, which seems generic, so we'll note that specific product CPE is missing but the affected product is Power Archiver versions up to 22.00.11. The exact root cause: When extracting files from archives that bear Mark-of-the-Web, PowerArchiver fails to apply proper security restrictions, allowing unsigned code to execute with elevated privileges. The attack vector is through the powerarc.exe executable. Since it's a remote attack (AV:N), the method likely involves sending a malicious archive to a user or a server that processes archives with PowerArchiver, leading to code execution. So educational: Mark-of-the-Web is a Windows mechanism that flags files downloaded from the internet; bypassing it can lead to arbitrary code execution.

risk_assessment: Use all signals. CVSS 9.8: network, low complexity, no privileges, no user interaction, scope unchanged, high impact. EPSS 0.36% (28th percentile) suggests low likelihood of exploitation in the wild currently. No KEV listing, so not actively exploited. SSVC: exploitation none, automatable yes, technical impact total. The low EPSS despite high CVSS indicates that while theoretically critical, real-world exploitation is not widespread, perhaps due to limited deployment footprint or other factors. The SSVC automatable=yes with exploitation=none suggests that it could be exploited automatically if motivated attackers target it. The missing CPE data (n/a) indicates no precise product matching, which may affect vulnerability scanners' ability to detect it. POC status unknown. The risk assessment should contrast CVSS with EPSS and mention that it's a critical-severity but not actively exploited, so prioritize based on asset exposure. I'll state that the vulnerability is severe but currently low-risk due to no known exploitation; organizations should still patch.

affected_products: Write paragraph listing product, version, and advisory. From description: "ConeXware, Inc Power Archiver v.22.00.11 and before". So version 22.00.11 and earlier. The CVE references include vendor site powerarchiver.com and a GitHub advisory. I'll link to the GitHub advisory as the reference. So: "Power Archiver by ConeXware, Inc, version 22.00.11 and all prior versions are affected. The vendor advisory or confirmation is available at the GitHub reference: https://github.com/OV-0-VO/Public-references/blob/main/CVE-2025-50329.md. The CPE identifier is reportedly cpe:2.3:a:n/a:n/a, which does not precisely identify the product, but the vendor's website is https://www.powerarchiver.com." That should work.

remediation: Start with primary fix: upgrade to a version later than 22.00.11, but the specific fixed version is not provided in the data. I'll check references: no mention of a patch version. The vendor site may have updates, but not given. So I'll state "Vendor-released patch: exact fix version not confirmed in the advisory; update to the latest version of Power Archiver beyond 22.00.11 as provided by ConeXware." If no patch, suggest workarounds: Disable automatic extraction of archives from the internet, ensure Mark-of-the-Web protections are enforced, or avoid opening untrusted archives. Since the vulnerability involves Mark-of-the-Web bypass, ensuring Windows security settings are enabled and not using PowerArchiver for untrusted archives could mitigate. Actionable: "Until a patched version is applied, users should avoid extracting archives from untrusted sources with PowerArchiver, and ensure that the 'Unblock' option is not used for files flagged with Mark-of-the-Web." Or use alternative extraction tools. I'll write: "Upgrade to the latest version of Power Archiver (beyond 22.00.11) as soon as a fix is available. In the interim, disable automatic extraction when downloading archives, avoid opening archives from untrusted sources with PowerArchiver, and consider using Windows built-in extraction tools that enforce Mark-of-the-Web properly. Monitor the vendor's website for an official advisory." I can cite the GitHub advisory as a reference for details. But the GitHub reference is not an official advisory, it's a public reference. The vendor website powerarchiver.com is the official source. I'll say: "No official patch version specified; refer to the vendor's website (https://www.powerarchiver.com) for updated versions." I'll note that the GitHub reference contains technical details. So remediation paragraph: "Upgrade Power Archiver to a patched version beyond 22.00.11 once released by ConeXware. As no fixed version number is confirmed in the vulnerability disclosure, consult the vendor's website for the latest update. For immediate mitigation, cease using Power Archiver to extract files from untrusted archives, particularly those bearing the Mark-of-the-Web, and rely on Windows' built-in extraction tools or other archivers that enforce security markings. Alternatively, block PowerArchiver's network access if feasible, but note this may impair legitimate functionality."

exploit_scenario: "An attacker crafts a malicious archive file containing executable content and sends it to a victim, perhaps via email or a download link. When the victim extracts the archive using a vulnerable version of PowerArchiver, the Mark-of-the-Web is ignored, allowing the executable to run with elevated privileges, leading to code execution and system compromise." That's a realistic scenario. No PoC confirmed, but the description implies.

exploitation_conditions: The CVE description says "via the powerarc.exe". The diff snippet mentions "extracting files from an archive that bears Mark-of-the-Web". So the condition is: user must extract a specially crafted archive using PowerArchiver on a Windows system where Mark-of-the-Web is present. No authentication required. So specific conditions: "Victim must extract a malicious archive file using Power Archiver 22.00.11 or earlier on a Windows system where the archive carries the Mark-of-the-Web. No authentication or special configuration is required." The limiting factor: requires user interaction (UI:N, but actually the user must open the archive). Wait, CVSS says UI:N, which means no user interaction is required. That seems contradictory to the extraction process. Possibly the attack can be triggered automatically when PowerArchiver processes an archive without user interaction, e.g., as a service? The description just says "via the powerarc.exe" — maybe it's a network-accessible service