CVE-2025-12247: Hasleo Backup Suite Path Vulnerability

CVE-2025-12247 Overview

CVE-2025-12247 is an unquoted search path vulnerability [CWE-426] affecting Hasleo Backup Suite versions up to 5.2. The flaw resides in the HasleoImageMountService and HasleoBackupSuiteService service components. Windows services registered with unquoted paths containing spaces allow attackers to place a malicious executable in an intermediate directory, which the Service Control Manager may execute in place of the legitimate binary. Exploitation requires local access with low privileges and is rated as high complexity. A public exploit is available. The vendor recommends upgrading the affected component to remediate the issue.

Critical Impact
A local attacker with write access to a privileged directory in the service path can execute arbitrary code in the context of the Hasleo service account, leading to privilege escalation.

Affected Products

Hasleo Backup Suite versions up to and including 5.2
HasleoImageMountService component
HasleoBackupSuiteService component

Discovery Timeline

2025-10-27 - CVE-2025-12247 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12247

Vulnerability Analysis

The vulnerability stems from improper quoting of the service binary path in the Windows Service Control Manager (SCM) registration for Hasleo Backup Suite. When a Windows service is registered with an unquoted ImagePath value containing spaces, the SCM attempts to resolve each space-delimited token as a potential executable. An attacker who can write to any intermediate directory in the resolved path can place a malicious executable that the SCM will launch when the service starts.

The attack requires local execution and is described as difficult to exploit, primarily because it depends on filesystem write permissions to a directory in the service path. When conditions align, the malicious binary runs with the privileges of the service account, typically LocalSystem, resulting in full compromise of the host.

According to EPSS data, the probability of exploitation in the wild is 0.158% with a percentile of 5.418, reflecting the localized nature and complexity of the flaw.

Root Cause

The root cause is a failure by the installer to enclose the service ImagePath registry value in quotation marks. When the path contains spaces and unquoted directory names, Windows parses the path ambiguously. The SCM will attempt each candidate executable in order until one succeeds, creating an opportunity for path hijacking.

Attack Vector

An authenticated local attacker identifies the unquoted service path for HasleoImageMountService or HasleoBackupSuiteService. The attacker then places a crafted executable in a writable intermediate directory along the service path. When the service is next started, either manually, at boot, or by triggering a Hasleo Backup Suite action, the Service Control Manager executes the attacker-controlled binary under the service's privilege level.

Because no verified proof-of-concept code is published in a structured form, refer to the referenced CVE-Discovery documentation on GitHub for technical exploitation details.

Detection Methods for CVE-2025-12247

Indicators of Compromise

Unexpected executable files placed in directories along the HasleoImageMountService or HasleoBackupSuiteService service paths, particularly at intermediate space-delimited locations.
New or modified files in root or Program Files directories that match candidate names such as Program.exe or Hasleo.exe.
Anomalous child processes spawned by the Hasleo service running under NT AUTHORITY\SYSTEM.

Detection Strategies

Enumerate all Windows services and inspect the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services\ for unquoted paths containing spaces.
Monitor Windows Security Event ID 4688 for process creation events where the parent is a Hasleo service and the child image path is outside expected installation directories.
Alert on file creation events in directories that appear within an unquoted service path.

Monitoring Recommendations

Establish baseline telemetry for service start events (Event ID 7036) and correlate with suspicious file creation in nearby directories.
Track directory access control list (ACL) changes in the Hasleo installation path and its parent directories.
Audit privilege escalation attempts originating from low-integrity user contexts on hosts with Hasleo Backup Suite installed.

How to Mitigate CVE-2025-12247

Immediate Actions Required

Upgrade Hasleo Backup Suite to a version later than 5.2 once the vendor releases a patched build. Download from the EasyUEFI website.
Audit the ImagePath for HasleoImageMountService and HasleoBackupSuiteService and manually quote the path if the vendor has not yet corrected it.
Restrict write permissions on directories along the service path to prevent unprivileged users from placing executables.

Patch Information

The vendor advisory recommends upgrading the affected component. No specific fixed version identifier is listed in the NVD entry at the time of publication. Consult the VulDB entry #329918 and vendor download page for the latest supported release.

Workarounds

Manually modify the service ImagePath in the registry to enclose the full binary path in double quotes, then restart the service.
Apply restrictive NTFS permissions to C:\, C:\Program Files\, and other intermediate directories to deny non-administrative write access.
Where operationally feasible, disable the HasleoImageMountService and HasleoBackupSuiteService services until the software is upgraded.

bash

# Verify and correct the unquoted service path (run as Administrator)
sc qc HasleoImageMountService
sc qc HasleoBackupSuiteService

# If the BINARY_PATH_NAME is unquoted, correct it:
sc config HasleoImageMountService binPath= "\"C:\Program Files\Hasleo\Backup Suite\HasleoImageMountService.exe\""
sc config HasleoBackupSuiteService binPath= "\"C:\Program Files\Hasleo\Backup Suite\HasleoBackupSuiteService.exe\""