CVE-2025-53947: Windows Privilege Escalation Vulnerability

CVE-2025-53947 Overview

CVE-2025-53947 describes an incorrect default permissions weakness [CWE-276] affecting a Windows-installed application referenced in CISA ICS Advisory ICSA-25-261-06. The software creates a data folder with overly permissive access control lists during installation. Any authenticated user on the host can modify the contents of this directory.

A local attacker with low privileges can leverage this weakness to corrupt sensitive data stored by the application. The vulnerability requires local access and low-level user privileges but no user interaction to exploit.

Critical Impact
Any authenticated Windows user can modify or corrupt application data files, undermining data integrity and application availability on affected systems.

Affected Products

Windows-installed software referenced in CISA ICS Advisory ICSA-25-261-06
Specific vendor and product details are enumerated in the CISA advisory
No CPE identifiers are currently listed in NVD for this CVE

Discovery Timeline

2025-09-18 - CVE-2025-53947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53947

Vulnerability Analysis

The flaw is a classic incorrect default permissions issue classified under [CWE-276]. During installation, the affected software provisions a data directory on the local file system with weak discretionary access control lists (DACLs). The permissions grant modify or write access to non-privileged users rather than restricting write access to administrators or the service account.

Exploitation does not require network access, elevated privileges, or user interaction. A logged-in low-privilege user can navigate to the data folder and alter files that the application trusts. The impact centers on data integrity and availability. Confidentiality is not directly affected because the flaw enables modification rather than disclosure of protected data.

Root Cause

The installer applies inherited or overly broad permissions to the data folder instead of setting a hardened access control list. This omission allows the built-in Users group, or a similar broad principal, to write to files that should be restricted to privileged accounts.

Attack Vector

An attacker with a valid low-privilege Windows account authenticates to the host locally or through Remote Desktop. The attacker then writes, replaces, or deletes files within the weakly permissioned data directory. Downstream, the affected application consumes these tampered files, resulting in data corruption or altered application behavior.

Because no verified proof-of-concept is published, technical exploitation details should be sourced from the CISA ICS Advisory ICSA-25-261-06.

Detection Methods for CVE-2025-53947

Indicators of Compromise

Unexpected modification timestamps on files inside the application data folder
File writes to the data directory originating from user accounts that are not the application service account or administrators
Application errors or integrity check failures referencing corrupted configuration or data files

Detection Strategies

Audit the DACL on the application data folder using icacls and flag directories where the BUILTIN\Users group holds write, modify, or full control rights
Enable Windows object access auditing on the affected directory to log write attempts by non-privileged principals
Correlate Windows Security Event ID 4663 events with process and user context to identify unauthorized writes

Monitoring Recommendations

Collect file integrity monitoring telemetry for the affected data directory and alert on modifications by unexpected user contexts
Forward Windows security logs to a central SIEM and build detections for write events targeting protected application paths
Baseline expected file writers for the application, then alert on deviations

How to Mitigate CVE-2025-53947

Immediate Actions Required

Identify installations of the affected software listed in CISA ICS Advisory ICSA-25-261-06 across the Windows estate
Manually restrict the data folder DACL so that only administrators and the required service account have write access
Restrict interactive and remote logon rights on affected hosts to reduce the pool of potential local attackers

Patch Information

Refer to the CISA ICS Advisory ICSA-25-261-06 for vendor-supplied patch details and fixed versions. Apply the vendor patch on all affected systems once available. NVD lists no specific CPE ranges at the time of publication.

Workarounds

Use icacls to remove write and modify permissions for the BUILTIN\Users group on the application data directory
Reapply hardened permissions after any application upgrade or repair operation, since installers may reset ACLs
Enforce the principle of least privilege on the host and restrict which accounts can log in locally to systems running the affected software

bash

# Configuration example: harden the data folder ACL with icacls
icacls "C:\ProgramData\<AffectedApp>\Data" /remove:g "BUILTIN\Users"
icacls "C:\ProgramData\<AffectedApp>\Data" /grant:r "BUILTIN\Administrators:(OI)(CI)F"
icacls "C:\ProgramData\<AffectedApp>\Data" /grant:r "NT SERVICE\<AppServiceAccount>:(OI)(CI)M"
icacls "C:\ProgramData\<AffectedApp>\Data" /inheritance:r