CVE-2025-61037 Race condition in n/a
A local attacker can exploit a race condition in the license management logic to execute arbitrary code with SYSTEM privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-61037?
CVE-2025-61037 is a high-severity vulnerability in n/a, published on 31 Dec 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local privilege escalation vulnerability exists in SevenCs ORCA G2 2.0.1.35 (EC2007 Kernel v5.22). The flaw is a Time-of-Check Time-of-Use (TOCTOU) race condition in the license management logic. The regService process, which runs with SYSTEM privileges, creates a fixed directory and writes files without verifying whether the path is an NTFS reparse point. By exploiting this race condition, an attacker can replace the target directory with a junction pointing to a user-controlled path. This causes the SYSTEM-level process to drop binaries in a location fully controlled by the attacker, allowing arbitrary code execution with SYSTEM privileges. The vulnerability can be exploited by any standard user with only a single UAC confirmation, making it highly practical and dangerous in real-world environments.
Weakness: CWE-367
Which versions are affected by CVE-2025-61037?
It affects 2 products.
Products include Sevencs Ec2007 Kernel, Sevencs Orca G2.
How do I fix CVE-2025-61037?
No fix has been published for CVE-2025-61037 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-61037 being exploited?
There is no known exploitation of CVE-2025-61037 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rw3j-4v23-wxg4.