jvndb - jvndb-2025-000082

jvndb-2025-000082

Vulnerability from jvndb

Published

2025-10-06 15:38

Modified

2025-10-06 15:38

Severity ?

7.8 (High) - cvssV3_0 - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Summary

The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries

Details

The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries. * Uncontrolled search path element (CWE-427) - CVE-2025-57781 This vulnerability is exploited by directing a user to download and place a crafted DLL file with the affected installer, and to execute the installer. Takeru Naito of MOTEX Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

References

▼	Type	URL
	JVN	https://jvn.jp/en/jp/JVN95806263/index.html
	JVN	https://jvn.jp/en/jp/JVN72748502/index.html
	JVN	https://jvn.jp/en/ta/JVNTA91240916/
	CVE	https://www.cve.org/CVERecord?id=CVE-2025-57781
	No Mapping(CWE-Other)	https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html

Impacted products

▼	Vendor	Product
	DENSO TEN Limited	(Multiple Products)

Show details on JVN DB website

JSON

To clipboard

{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000082.html",
  "dc:date": "2025-10-06T15:38+09:00",
  "dcterms:issued": "2025-10-06T15:38+09:00",
  "dcterms:modified": "2025-10-06T15:38+09:00",
  "description": "The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries.\r\n\r\n* Uncontrolled search path element (CWE-427) - CVE-2025-57781\r\n\r\nThis vulnerability is exploited by directing a user to download and place a crafted DLL file with the affected installer, and to execute the installer.\r\n\r\nTakeru Naito of MOTEX Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2025/JVNDB-2025-000082.html",
  "sec:cpe": {
    "#text": "cpe:/o:misc:densoten_multiple_product",
    "@product": "(Multiple Products)",
    "@vendor": "DENSO TEN Limited",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "7.8",
    "@severity": "High",
    "@type": "Base",
    "@vector": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
    "@version": "3.0"
  },
  "sec:identifier": "JVNDB-2025-000082",
  "sec:references": [
    {
      "#text": "https://jvn.jp/en/jp/JVN95806263/index.html",
      "@id": "JVN#95806263",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/jp/JVN72748502/index.html",
      "@id": "JVN#72748502",
      "@source": "JVN"
    },
    {
      "#text": "https://jvn.jp/en/ta/JVNTA91240916/",
      "@id": "JVNTA#91240916",
      "@source": "JVN"
    },
    {
      "#text": "https://www.cve.org/CVERecord?id=CVE-2025-57781",
      "@id": "CVE-2025-57781",
      "@source": "CVE"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-Other",
      "@title": "No Mapping(CWE-Other)"
    }
  ],
  "title": "The installers of DENSO TEN drive recorder viewer may insecurely load Dynamic Link Libraries"
}

CVE-2025-57781 (GCVE-0-2025-57781)

Vulnerability from cvelistv5

Published

2025-10-06 05:16

Modified

2025-10-06 17:19

Severity ?

7.8 (High) - CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
8.4 (High) - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-427 - Uncontrolled Search Path Element

Summary

The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer.

References

▼	URL	Tags
	https://www.denso-ten.com/jp/information/topics/2025/1002
	https://jvn.jp/en/jp/JVN95806263/

Impacted products

	Vendor	Product	Version
	DENSO TEN Limited.	Multiple installers of DENSO TEN drive recorder viewer	Version: see the information provided by the vendor

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-57781",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-06T17:18:49.439425Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-06T17:19:23.118Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Multiple installers of DENSO TEN drive recorder viewer",
          "vendor": "DENSO TEN Limited.",
          "versions": [
            {
              "status": "affected",
              "version": "see the information provided by the vendor"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The installers of DENSO TEN drive recorder viewer contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with the privilege of the user invoking the installer."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        },
        {
          "cvssV4_0": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-427",
              "description": "Uncontrolled Search Path Element",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-06T05:16:29.331Z",
        "orgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
        "shortName": "jpcert"
      },
      "references": [
        {
          "url": "https://www.denso-ten.com/jp/information/topics/2025/1002"
        },
        {
          "url": "https://jvn.jp/en/jp/JVN95806263/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "ede6fdc4-6654-4307-a26d-3331c018e2ce",
    "assignerShortName": "jpcert",
    "cveId": "CVE-2025-57781",
    "datePublished": "2025-10-06T05:16:29.331Z",
    "dateReserved": "2025-10-01T05:53:34.423Z",
    "dateUpdated": "2025-10-06T17:19:23.118Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted