CVE-2025-64151

Multiple Roboticsware products provided by Roboticsware PTE. LTD. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

Score

CVSS 4.0 8.4 High

Status

Deferred - vultures@jpcert.or.jp

Published

2025-11-05

Last modified

2026-10-18

Weaknesses

CWE-428

Affected products

• Ba-panel6 (Roboticsware Pte. Ltd.)
• Fa-panel6 (Roboticsware Pte. Ltd.)
• Fa-server6 (Roboticsware Pte. Ltd.)
• Pa-panel6 (Roboticsware Pte. Ltd.)

References

• https://www.roboticsware.com/dev-jp/2025/10/28/announcements-20251028/
• https://jvn.jp/en/jp/JVN92563420/