CVE-2025-35978 Overview
CVE-2025-35978 is an improper restriction of communication channel to intended endpoints vulnerability [CWE-923] affecting Fujitsu UpdateNavi and UpdateNaviInstallService Service. The flaw allows a local authenticated attacker to send malicious data to the affected components. Successful exploitation results in arbitrary registry value modification or arbitrary code execution on the host.
Critical Impact
A local authenticated attacker can modify arbitrary registry values or execute arbitrary code by sending crafted data to an insufficiently restricted communication channel exposed by UpdateNavi.
Affected Products
- Fujitsu UpdateNavi V1.4 L10 through V1.4 L33
- Fujitsu UpdateNaviInstallService Service 1.2.0091 through 1.2.0125
- Fujitsu client systems shipping with the vulnerable update utility
Discovery Timeline
- 2025-06-12 - CVE-2025-35978 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-35978
Vulnerability Analysis
The vulnerability originates in the inter-process communication channel exposed by UpdateNavi and the associated UpdateNaviInstallService Service. The channel does not adequately restrict which endpoints can connect and issue commands. A local authenticated user can therefore interact with a privileged service that should only accept requests from trusted callers. Because the service performs registry writes and update-related execution on behalf of clients, unrestricted access translates directly into privileged operations for the attacker.
Root Cause
The root cause is classified as [CWE-923]: Improper Restriction of Communication Channel to Intended Endpoints. The service accepts requests without properly validating the caller identity or restricting the channel to authorized processes. This design flaw breaks the trust boundary between a low-privileged user session and the higher-privileged service handling update operations.
Attack Vector
Exploitation requires local access and valid authentication on the target system. The attacker connects to the exposed communication endpoint of UpdateNavi or UpdateNaviInstallService Service and submits crafted payloads. Depending on the request, this results in modification of arbitrary registry values or execution of arbitrary code in the context of the service. No user interaction is required beyond the attacker's own authenticated session.
No verified proof-of-concept code has been published. See the Fujitsu Security Update Information and JVN Vulnerability Report JVN17860456 for vendor and coordinator details.
Detection Methods for CVE-2025-35978
Indicators of Compromise
- Unexpected registry modifications performed by UpdateNavi.exe or the UpdateNaviInstallService Service process outside of scheduled update windows.
- New or modified child processes spawned by the UpdateNavi service that do not match known update binaries.
- Local IPC connections to the UpdateNavi service originating from non-Fujitsu update client processes.
Detection Strategies
- Inventory endpoints for installed versions of UpdateNavi in the range V1.4 L10 to V1.4 L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125.
- Monitor process ancestry to identify unusual callers of the UpdateNavi service performing registry or execution actions.
- Alert on writes to sensitive registry hives (for example, HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run) attributed to the update service.
Monitoring Recommendations
- Enable Windows Security auditing for registry object access on run keys, service keys, and image file execution options.
- Collect Sysmon Event ID 12/13/14 (registry) and Event ID 1 (process creation) with parent-child telemetry into a central SIEM.
- Baseline normal UpdateNavi behavior over a known-good period, then alert on deviations in caller identity, timing, or command frequency.
How to Mitigate CVE-2025-35978
Immediate Actions Required
- Identify all Fujitsu client systems running vulnerable versions of UpdateNavi and UpdateNaviInstallService Service.
- Apply the vendor-supplied update as described in the Fujitsu security bulletin at the earliest opportunity.
- Restrict interactive and remote local logon rights on affected hosts to reduce the pool of potential authenticated attackers.
Patch Information
Fujitsu has published remediation guidance in the Fujitsu Security Update Information advisory. Administrators should upgrade UpdateNavi and UpdateNaviInstallService Service to the fixed releases identified in the bulletin. Additional coordination details are available in the JVN Vulnerability Report JVN17860456.
Workarounds
- If patching cannot be performed immediately, disable or stop the UpdateNaviInstallService Service until the update is applied.
- Enforce least privilege by removing standard user accounts from systems where they are not required to log on locally.
- Apply application control policies to prevent unauthorized processes from interacting with the UpdateNavi service endpoint.
# Configuration example: query and stop the vulnerable service on Windows
sc.exe query "UpdateNaviInstallService"
sc.exe stop "UpdateNaviInstallService"
sc.exe config "UpdateNaviInstallService" start= disabled
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
