CVE-2025-35978

6.9 mediumEPSS 0.1%

Medium (6.9). EPSS 0.1% chance of exploitation in the next 30 days.

Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be executed.

Severity

CVSS 4.0

6.9 medium

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.0

7.1 high

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS: 0.1% chance of exploitation in the next 30 days; higher than 2% of CVEs (scores of 2026-10-31)
CWE: CWE-923
Published: 2025-06-12
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://azby.fmworld.net/support/security/information/updatenavi202506/
https://jvn.jp/en/jp/JVN17860456/

Check your stack JSON