by Kastro
Paper/Archive/CVE-2025-26692

CVE-2025-26692

SIOS Technology, Inc. Quick Agent V3 — Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal').

EPSS 0.9%CVSS 9.2
critical.is priorityof 100
39
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 59.0.590 × 2011.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Quick Agent V3 and Quick Agent V2 contain an issue with improper limitation of a pathname to a restricted directory ('Path Traversal'). If exploited, arbitrary code may be executed by a remote unauthenticated attacker with the Windows system privilege where the product is running.

Affected

ProductAffectedFixed inSource
Quick Agent V3prior to Ver3.2.1–CNA
Quick Agent V2prior to Ver2.9.8–CNA

Scores by source

jpcert (CNA)9.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
jpcert (CNA)8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refmfp-support.sios.jp/hc/ja/articles/45853460006937refsiosapps.sios.jp/agent_info/20250425001.htmlrefjvn.jp/en/jp/JVN82536398