CVE-2025-39246: HikCentral FocSign Privilege Escalation

CVE-2025-39246 Overview

CVE-2025-39246 is an unquoted service path vulnerability [CWE-428] affecting certain versions of HikCentral FocSign from Hikvision. The flaw exists in how the Windows service registers its executable path without proper quoting. An authenticated local user can place a malicious executable in a higher-priority path location. When the affected service starts, Windows may execute the attacker-controlled binary instead of the intended service executable. This behavior enables privilege escalation in the context of the service account.

Critical Impact
An authenticated local user can achieve privilege escalation by placing a malicious executable in a directory that Windows resolves before the legitimate HikCentral FocSign service binary.

Affected Products

HikCentral FocSign (specific vulnerable versions listed in the Hikvision Security Advisory)
Windows deployments running the affected FocSign service
Environments where local authenticated users have write access to root or intermediate directories

Discovery Timeline

2025-08-29 - CVE-2025-39246 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39246

Vulnerability Analysis

The vulnerability stems from an unquoted service path in the HikCentral FocSign Windows service configuration. Windows service definitions store the executable path in the registry under ImagePath. When this path contains spaces and lacks surrounding quotation marks, the Windows Service Control Manager (SCM) attempts to interpret each space-delimited segment as a potential executable. This behavior is classified under [CWE-428] Unquoted Search Path or Element.

An attacker who has write access to any intermediate directory along the service path can drop a malicious binary matching the expected segment name. On service startup, Windows loads and executes the attacker's binary under the service account context — typically LocalSystem or another privileged account. The exploitation requires local access and authenticated user privileges, but the payoff is elevated code execution.

The issue is not a memory corruption bug and does not require crafted input. It is a configuration flaw at the service registration layer that combines with default Windows path-resolution semantics.

Root Cause

The root cause is improper quoting of the service binary path during installation. Developers registered the service using a path that contains spaces without wrapping the full path in double quotes. Windows SCM then treats the path ambiguously and searches multiple candidate locations before reaching the intended binary.

Attack Vector

Exploitation requires local authenticated access to the target Windows host running HikCentral FocSign. The attacker identifies the unquoted ImagePath for the FocSign service, then writes a malicious executable to a directory earlier in the resolution order. When the service restarts — through reboot, administrative action, or update — Windows launches the attacker-supplied binary with the privileges of the service account. The vulnerability is described in the Hikvision Security Advisory.

Detection Methods for CVE-2025-39246

Indicators of Compromise

Unexpected executables placed in root directories such as C:\Program.exe or intermediate path segments along the FocSign install directory
New or modified files in directories that precede the legitimate FocSign binary in the service ImagePath
Windows Event Log entries showing the FocSign service starting an unexpected process or failing to launch its intended binary

Detection Strategies

Enumerate all services on hosts running HikCentral FocSign and inspect the ImagePath registry value under HKLM\SYSTEM\CurrentControlSet\Services for unquoted paths containing spaces
Audit filesystem ACLs on directories along the service path to confirm non-administrative users lack write permissions
Alert on process creation events where a Windows service parent spawns a binary from an unexpected filesystem location

Monitoring Recommendations

Monitor Windows Security Event ID 4688 for process creation under service accounts running from non-standard paths
Track file creation events in root drive directories and any intermediate path segments used by the FocSign service
Review service configuration changes via Event ID 7045 (new service installed) and Event ID 4657 (registry value modification on ImagePath)

How to Mitigate CVE-2025-39246

Immediate Actions Required

Apply the vendor-provided update referenced in the Hikvision Security Advisory to affected HikCentral FocSign installations
Inventory Windows hosts running FocSign and identify any service with an unquoted ImagePath
Restrict write permissions on root and intermediate directories that appear in the service path

Patch Information

Hikvision has published guidance for affected HikCentral products. Administrators should consult the vendor advisory for the specific fixed FocSign versions and follow the documented upgrade procedure. Verify service configuration after upgrading to confirm the ImagePath is properly quoted.

Workarounds

Manually correct the service ImagePath value in the registry by wrapping the full executable path in double quotes, then restart the service
Remove write permissions for non-administrative accounts on C:\ and any parent directories along the FocSign service path
Limit interactive and remote logon rights on servers hosting FocSign to reduce the pool of users capable of local exploitation

bash

# Configuration example: inspect and correct an unquoted service path (run as Administrator)
# 1. Query the current ImagePath
sc qc "FocSignServiceName"

# 2. Update the service binary path with proper quoting
sc config "FocSignServiceName" binPath= "\"C:\Program Files\HikCentral FocSign\FocSign.exe\""

# 3. Restart the service to apply the change
sc stop "FocSignServiceName"
sc start "FocSignServiceName"