CVE-2025-8070 Windows service registered with an unquoted ImagePath vulnerability in the system registry
Local attackers can escalate privileges to SYSTEM by exploiting unquoted service paths in ASUSTOR ABP and AES software.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-8070?
CVE-2025-8070 is a critical vulnerability in ASUSTOR ABP and AES, published on 23 Jul 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The Windows service configuration of ABP and AES contains an unquoted ImagePath registry value vulnerability. This allows a local attacker to execute arbitrary code by placing a malicious executable in a predictable location such as C:\Program.exe. If the service runs with elevated privileges, exploitation results in privilege escalation to SYSTEM level. This vulnerability arises from an unquoted service path affecting systems where the executable resides in a path containing spaces. Affected products and versions include: ABP 2.0.7.6130 and earlier as well as AES 1.0.6.6133 and earlier.
Weakness: CWE-428
Which versions are affected by CVE-2025-8070?
How do I fix CVE-2025-8070?
No fix has been published for CVE-2025-8070 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-8070 being exploited?
There is no known exploitation of CVE-2025-8070 in the wild and no public exploit code.
Sources
Also known as GHSA-6q9j-6jj7-h2cx.