CVE-2025-57699

Western Digital Kitfox for Windows provided by Western Digital Corporation registers a Windows service with an unquoted file path. A user with the write permission on the root directory of the system drive may execute arbitrary code with the SYSTEM privilege.

Score

CVSS 4.0 8.4 High

Status

Deferred - vultures@jpcert.or.jp

Published

2025-08-22

Last modified

2025-08-22

Weaknesses

CWE-428

Affected products

• Western Digital Kitfox For Windows (Western Digital Corporation)

References

• https://jvn.jp/en/jp/JVN75211379/
• https://www.westerndigital.com/support/product-security/wdc-25004-western-digital-kitfox-software-version-1-1-1-1