CVE-2025-9043 PoC — Seagate Toolkit 安全漏洞

Source

https://github.com/Tiger3080/CVE-2025-9043

Associated Vulnerability

Title:Seagate Toolkit 安全漏洞 (CVE-2025-9043)
Description:Seagate Toolkit是美国Seagate公司的一个用于管理和备份数据的软件。 Seagate Toolkit 2.34.0.33之前版本存在安全漏洞，该漏洞源于未引用的搜索路径或元素，可能导致执行恶意文件。

Readme

# CVE-2025-9043

## Description
An **Unquoted Search Path or Element** vulnerability (CWE-428) exists in **Seagate Toolkit** on Windows versions prior to **2.34.0.33**.  
The service executable path is not properly quoted, allowing an attacker with **administrative privileges** and **write access** to the root of the affected directory to place a malicious `Program.exe` file. When the vulnerable service is started, the malicious binary executes with **SYSTEM** privileges.

## Affected Product
- **Vendor:** Seagate Technology  
- **Product:** Seagate Toolkit  
- **Platform:** Windows  
- **Version:** Prior to 2.34.0.33  
- **Component:** Service executable path

## Vulnerability Details
- **Vulnerability Type:** Unquoted Search Path or Element (CWE-428)  
- **Attack Type:** Local 
- **Impact:**  
  - Escalation to SYSTEM privileges  
- **CVE ID:** [CVE-2025-9043](https://nvd.nist.gov/vuln/detail/CVE-2025-9043)  
- **CVSS Score (CNA):** 6.7 (Medium)  
- **CVSS Vector:** `CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N`

## Discoverer
Natthawut Saexu

## Proof of Concept (PoC)
The tester prepared a malicious DLL and a script to continuously copy it to the user-controlled path.
![PoC Screenshot](images/1.png)

The tester ran the installer and changed the installation path to a user-controllable location.
![PoC Screenshot](images/2.png)

After the installation completed, the tester gained a reverse shell back to the attack machine with SYSTEM privileges.
![PoC Screenshot](images/3.png)
![PoC Screenshot](images/4.png)

## References
- [NVD – CVE-2025-9043](https://nvd.nist.gov/vuln/detail/CVE-2025-9043)  
- [MITRE CVE Record](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9043)  
- [Vendor Advisory – Seagate](https://www.seagate.com/product-security/#security-advisories)

File Snapshot


 [4.0K]  /data/pocs/874ec8a0d47d876f1a94b6009b4559b905ef1413
├── [4.0K]  images
│   ├── [ 87K]  1.png
│   ├── [350K]  2.png
│   ├── [520K]  3.png
│   └── [1.4M]  4.png
└── [1.8K]  README.md

1 directory, 5 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!