memoQ Auto Update Service Unquoted Service Path Vulnerability (CVE-2025-60320)

Key Information Vulnerability Overview CVE ID: CVE-2025-60320 Disclosure Date: 2025-10-29 Discoverer: José Raeiro (@joseraeiro) Vulnerability Details Vulnerability Type: Unquoted Service Path (CWE-428) Affected Product: memoQ Auto Update Service Service Name: memoQuaUp1p01 Affected Versions: memoQ versions 10.1.13.ef1b2b2aae and earlier Fixed Version: Latest version (exact version to be confirmed by vendor) Technical Details Example Configuration: - Service Name: memoQuaUp1p01 - Image Path: C:\Program Files\memoQ\memoq-10\MemoQ_AutoUpdate.exe Issue: Path contains spaces and is unquoted, potentially allowing the system to execute unintended executable files. Impact Local Privilege Escalation: NT AUTHORITY\SYSTEM CVSS v3.1 Score: 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Environmental Impact: If C:\ or earlier path elements are writable by low-privileged users, PR drops to Low, resulting in a score of 7.8. Proof of Concept (PoC) 1. Place a controlled executable file in C:\. 2. Restart the memoQ Auto Update Service or reboot the system. 3. Payload executes with SYSTEM privileges. Mitigation Upgrade: To the latest version, ensuring the path is properly quoted. Temporary Fix: Use command to update the service configuration. Hardening: Ensure non-privileged users cannot write to C:\ or other early path elements. Timeline 2025-08-07: Discovered and reported to vendor. 2025-08-14: Vendor acknowledged and stated latest version is fixed. 2025-10-23: MITRE assigned CVE ID. 2025-10-29: Public advisory released. References CWE-428 — Unquoted Search Path or Element Microsoft guidance on unquoted service paths and EoP

Goal Reached Thanks to every supporter — we hit 100%!

memoQ Auto Update Service Unquoted Service Path Vulnerability (CVE-2025-60320)

More from this source