CVE-2025-30248: WD Discovery DLL Hijacking Vulnerability

CVE-2025-30248 Overview

CVE-2025-30248 is a DLL hijacking vulnerability in the Western Digital WD Discovery Installer on Windows. The flaw affects WD Discovery version 5.2.730 and allows a local attacker to execute arbitrary code by placing a crafted Dynamic Link Library (DLL) into the installer's search path. The weakness is classified as [CWE-427] Uncontrolled Search Path Element. Western Digital addressed the issue in WD Discovery 5.3. The vulnerability requires user interaction to trigger execution of the installer and does not currently have a public proof-of-concept exploit.

Critical Impact
Successful exploitation grants arbitrary code execution in the context of the user running the WD Discovery Installer, which can lead to full host compromise when the installer runs with elevated privileges.

Affected Products

Western Digital WD Discovery 5.2.730 on Windows
WD Discovery Installer (versions prior to 5.3)
Windows endpoints where the installer is executed from a writable directory

Discovery Timeline

2026-01-26 - CVE-2025-30248 published to the National Vulnerability Database (NVD)
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-30248

Vulnerability Analysis

The WD Discovery Installer loads one or more DLLs without specifying a fully qualified path. Windows then resolves the DLL name using its default search order, which includes the directory from which the application loaded. An attacker who can drop a malicious DLL into that directory causes the installer to load attacker-controlled code instead of the legitimate library. Code executes with the privileges of the user invoking the installer, which is frequently an administrator during software setup.

Root Cause

The root cause is an uncontrolled search path element [CWE-427]. The installer does not call SetDllDirectory, does not use safe search mode flags such as LOAD_LIBRARY_SEARCH_SYSTEM32, and does not validate the integrity or origin of dependent libraries. Any DLL with a matching name placed earlier in the resolution order is loaded without signature checks.

Attack Vector

Exploitation requires a local attacker to plant a crafted DLL in a directory included in the installer's DLL search path, typically the same folder as the installer executable or a writable directory referenced by PATH. The attacker then waits for or socially engineers a user into launching the WD Discovery Installer. Common delivery vectors include extracting the installer alongside a malicious DLL inside a ZIP archive or staging both files in a shared download directory. Once the installer runs, the malicious DLL is loaded automatically.

No verified public proof-of-concept code is available. Refer to the Western Digital Security Advisory for vendor-provided technical detail.

Detection Methods for CVE-2025-30248

Indicators of Compromise

Unsigned or unexpected DLL files located in the same directory as WDDiscovery installer binaries or in user Downloads folders.
Process creation events showing the WD Discovery Installer loading DLLs from non-standard paths outside C:\Windows\System32.
Child processes spawned by the installer that do not match Western Digital's legitimate post-install behavior.

Detection Strategies

Monitor ImageLoad telemetry for the WD Discovery Installer process and alert on DLLs loaded from user-writable directories.
Correlate installer execution with file creation events of DLL files in the same parent directory within a short time window.
Hunt for execution of WD Discovery Installer versions earlier than 5.3 across managed endpoints.

Monitoring Recommendations

Enable Microsoft Sysmon Event ID 7 (Image Loaded) and forward to a centralized analytics platform for search path analysis.
Apply application control policies such as Windows Defender Application Control (WDAC) or AppLocker to block unsigned DLLs from loading.
Track endpoint inventory for installations of WD Discovery 5.2.730 and prioritize them for remediation.

How to Mitigate CVE-2025-30248

Immediate Actions Required

Upgrade WD Discovery to version 5.3 or later on all Windows endpoints.
Remove older WD Discovery installer binaries from shared folders, removable media, and user download directories.
Instruct users to run installers only from clean, dedicated directories that contain no untrusted files.

Patch Information

Western Digital released WD Discovery 5.3 to remediate this vulnerability. Patch details and download links are available in the Western Digital Security Advisory.

Workarounds

Run the installer from a freshly created empty directory that contains no other files.
Restrict write access to directories where installers are commonly executed to prevent DLL plant attacks.
Enforce code-signing verification for DLLs through application control policies until patching completes.

bash

# Verify installed WD Discovery version on Windows via PowerShell
Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
  Where-Object { $_.DisplayName -like 'WD Discovery*' } |
  Select-Object DisplayName, DisplayVersion, InstallLocation